SMS Alert Order Notifications – WooCommerce < 3.4.7 Authenticated Cross Site Scripting

The plugin is affected by a cross site scripting (XSS) vulnerability in the plugin’s setting page.

PoC

Enter the payload below for the “SMS Alert Username” in the plugin’s settings. “+onfocus=“alert(1)”+autofocus=” You will observe that the JavaScript payload successfully got reflected is and we are getting a pop-up.