The persian-woocommerce-sms plugin prior to 3.3.4 for WordPress has ps_sms_numbers XSS.
woocommerce persian woocommerce sms