WordPress International SMS for Contact Form 7 Integration Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in the WordPress plugin 'International SMS for Contact Form 7 Integration' version 1.2. The issue resides in the admin settings interface, specifically within the 'page' parameter of 'class-sms-log-display.php'. This vulnerability allows attackers to inject malicious scripts that are executed as arbitrary JavaScript in the browsers of administrators.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where injected scripts are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, navigate to the admin settings interface of the affected WordPress plugin. Inject a script into the 'page' parameter, which will be processed by 'class-sms-log-display.php'. The injected script, such as a JavaScript alert, will execute in the browser of the administrator.