Plugin icon

SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery

sms-alert

Vulnerabilities:

28

Last Updated:

October 28, 2026

Active Installs:

3000

Published
Title
Fixed in
CVSS
Published
2026-10-15
Title
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery < 4.0.2 - Missing Authorization
Fixed in
Fixed in 4.0.2
CVSS
4.3 (medium)
Published
2026-10-08
Title
SMS Alert 3.9.6 - 4.0.0 - Unauthenticated Privilege Escalation via Arbitrary Password Reset
Fixed in
Fixed in 4.0.1
CVSS
8.1 (high)
Published
2026-10-08
Title
SMS Alert 4.0.0 - Unauthenticated Authentication Bypass via Login with OTP
Fixed in
Fixed in 4.0.1
CVSS
8.1 (high)
Published
2026-10-06
Title
SMS Alert 3.6.4 - 4.0.0 - Admin+ Network User Billing Phone Disclosure via Bulk User Actions
Fixed in
Fixed in 4.0.1
CVSS
2.7 (low)
Published
2026-10-05
Title
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery < 4.0.1 - Unauthenticated Privilege Escalation
Fixed in
Fixed in 4.0.1
CVSS
7.3 (high)
Published
2026-09-11
Title
SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery < 4.0.0 - Authenticated (Subscriber+) Privilege Escalation
Fixed in
Fixed in 4.0.0
CVSS
6.3 (medium)
Published
2026-08-06
Title
SMS Alert Order Notifications < 3.9.8 - Unauthenticated Privilege Escalation
Fixed in
Fixed in 3.9.8
CVSS
7.3 (high)
Published
2026-07-27
Title
SMS Alert < 3.9.8 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
Fixed in
Fixed in 3.9.8
CVSS
4.9 (medium)
Published
2026-07-27
Title
SMS Alert < 3.9.8 - Authenticated (Administrator+) SQL Injection via 'checkout_payment_plans' and 'order_status' Settings
Fixed in
Fixed in 3.9.8
CVSS
4.4 (medium)
Published
2026-07-27
Title
SMS Alert < 3.9.8 - Authenticated (Administrator+) SQL Injection via 'id' Parameter
Fixed in
Fixed in 3.9.8
CVSS
4.9 (medium)
Published
2026-07-22
Title
SMS Alert < 3.9.7 - Unauthenticated Missing Authorization via reset_style and smsalert-group-sync Actions
Fixed in
Fixed in 3.9.7
CVSS
5.3 (medium)
Published
2026-07-20
Title
SMS Alert Order Notifications – WooCommerce < 3.9.8 - Unauthenticated Account Takeover via Unbound OTP Verification in Signup-with-Mobile
Fixed in
Fixed in 3.9.8
CVSS
9.8 (critical)
Published
2026-06-30
Title
SMS Alert < 3.9.6 - Unauthenticated Privilege Escalation via Arbitrary Password Reset
Fixed in
Fixed in 3.9.6
CVSS
9.8 (critical)
Published
2026-06-16
Title
SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery < 3.9.5 - Authenticated (Subscriber+) Privilege Escalation
Fixed in
Fixed in 3.9.5
CVSS
6.3 (medium)
Published
2026-06-16
Title
SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery < 3.9.4 - Missing Authorization
Fixed in
Fixed in 3.9.4
CVSS
5.3 (medium)
Published
2026-02-18
Title
SMS Alert Order Notifications < 3.9.1 - Missing Authorization
Fixed in
Fixed in 3.9.1
CVSS
4.3 (medium)
Published
2025-12-05
Title
SMS Alert Order Notifications < 3.8.9 - Missing Authorization
Fixed in
Fixed in 3.8.9
CVSS
5.3 (medium)
Published
2025-08-15
Title
SMS Alert Order Notifications < 3.8.6 - Unauthenticated SQL Injection
Fixed in
Fixed in 3.8.6
CVSS
7.5 (high)
Published
2025-05-09
Title
SMS Alert Order Notifications – WooCommerce < 3.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via sa_verify Shortcode
Fixed in
Fixed in 3.8.2
CVSS
6.4 (medium)
Published
2025-05-09
Title
SMS Alert Order Notifications – WooCommerce < 3.8.2 - Authenticated (Subscriber+) Privilege Escalation via handleWpLoginCreateUserAction Function
Fixed in
Fixed in 3.8.2
CVSS
8.8 (high)
Published
2025-05-08
Title
SMS Alert Order Notifications – WooCommerce < 3.8.2 - Unauthenticated SQL Injection
Fixed in
Fixed in 3.8.2
CVSS
7.5 (high)
Published
2025-03-31
Title
SMS Alert Order Notifications < 3.8.0 - Unauthenticated Account Takeover/Privilege Escalation
Fixed in
Fixed in 3.8.0
CVSS
9.8 (critical)
Published
2025-03-02
Title
SMS Alert Order Notifications – WooCommerce < 3.7.9 - Unauthenticated SQL Injection
Fixed in
Fixed in 3.7.9
CVSS
7.5 (high)
Published
2025-02-23
Title
SMS Alert Order Notifications – WooCommerce < 3.7.9 - Reflected Cross-Site Scripting
Fixed in
Fixed in 3.7.9
CVSS
6.1 (medium)
Published
2025-01-06
Title
SMS Alert Order Notifications – WooCommerce < 3.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
Fixed in
Fixed in 3.7.7
CVSS
8.8 (high)
Published
2024-10-28
Title
SMSAlert - WooCommerce < 3.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via sa_subscribe Shortcode
Fixed in
Fixed in 3.7.6
CVSS
6.4 (medium)
Published
2024-02-26
Title
SMS Alert Order Notifications – WooCommerce < 3.7.0 - Cross-Site Request Forgery
Fixed in
Fixed in 3.7.0
CVSS
4.3 (medium)
Published
2021-08-02
Title
SMS Alert Order Notifications – WooCommerce < 3.4.7 Authenticated Cross Site Scripting
Fixed in
Fixed in 3.4.7
CVSS
3.8 (low)