CVE-2025-26984

High

Published: 03 March 2025

Published

03 March 2025

Modified

23 April 2026

KEV Added

—

Patch

—

CVSS Score 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

EPSS Score 0.0020 42.1th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-26984 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Cozyvision Sms Alert Order Notifications. Its CVSS base score is 7.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 42.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-15 Information Output Filtering good match

prevent

Directly addresses improper neutralization of input during web page generation by filtering outputs to prevent reflected XSS script injection.

SI-10 Information Input Validation good match

prevent

Validates untrusted inputs from unauthenticated users to block malicious payloads that could be reflected as XSS in the WordPress plugin.

SI-2 Flaw Remediation good match

prevent

Remediates the specific reflected XSS flaw in the SMS Alert Order Notifications plugin through timely patching to versions beyond 3.7.8.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1204.001 Malicious Link Execution

An adversary may rely upon a user clicking a malicious link in order to gain execution.

attack.mitre.org →

T1059.007 JavaScript Execution

Adversaries may abuse various implementations of JavaScript for execution.

attack.mitre.org →

Why these techniques?

Reflected XSS in public-facing WordPress plugin enables T1190 exploitation via crafted malicious URLs (T1204.001) that trigger JavaScript execution (T1059.007) in the victim's browser.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozy Vision SMS Alert Order Notifications sms-alert allows Reflected XSS.This issue affects SMS Alert Order Notifications: from n/a through <= 3.7.8.

Deeper analysisAI

CVE-2025-26984 is an Improper Neutralization of Input During Web Page Generation vulnerability, classified as Reflected Cross-site Scripting (XSS) under CWE-79, in the Cozy Vision SMS Alert Order Notifications plugin (sms-alert) for WordPress. This issue affects all versions of the plugin from its initial release through 3.7.8.

The vulnerability carries a CVSS v3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Unauthenticated attackers with network access can exploit it through low-complexity attacks that require user interaction, such as tricking victims into visiting a malicious URL or interacting with crafted input reflected on the page. Exploitation enables script execution in the context of the victim's browser, resulting in low impacts to confidentiality, integrity, and availability, with a changed scope.

The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/sms-alert/vulnerability/wordpress-sms-alert-order-notifications-woocommerce-plugin-3-7-8-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve) documents this vulnerability in the WordPress SMS Alert Order Notifications WooCommerce plugin version 3.7.8, recommending mitigation through updating to a patched version beyond 3.7.8.