Plugin icon

WSMS (formerly WP SMS) – SMS & MMS Notifications with OTP and 2FA for WooCommerce

wp-sms

Vulnerabilities:

15

Last Updated:

March 17, 2026

Active Installs:

9000

Published
Title
Fixed in
CVSS
Published
2026-02-10
Title
WSMS (formerly WP SMS) – SMS & MMS Notifications with OTP and 2FA for WooCommerce < 7.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Fixed in
Fixed in 7.1.1
CVSS
4.4 (medium)
Published
2025-10-16
Title
WP SMS < 7.0.2 - Missing Authorization
Fixed in
Fixed in 7.0.2
CVSS
4.3 (medium)
Published
2024-08-16
Title
WP SMS < 6.9.4 - Missing Authorization
Fixed in
Fixed in 6.9.4
CVSS
5.3 (medium)
Published
2024-05-13
Title
WP SMS < 6.5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
Fixed in
Fixed in 6.5.2
CVSS
4.4 (medium)
Published
2024-03-28
Title
WP SMS < 6.6.3 - Cross-Site Request Forgery
Fixed in
Fixed in 6.6.3
CVSS
4.3 (medium)
Published
2024-02-14
Title
WP SMS < 6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Fixed in
Fixed in 6.4
CVSS
6.4 (medium)
Published
2024-02-05
Title
WP SMS < 6.5.3 - Reflected Cross-Site Scripting via 'page'
Fixed in
Fixed in 6.5.3
CVSS
6.1 (medium)
Published
2024-01-12
Title
WP SMS < 6.5.2 - Contributor+ Stored Cross-Site Scripting
Fixed in
Fixed in 6.5.2
CVSS
6.4 (medium)
Published
2024-01-02
Title
WP SMS < 6.5.1 - Contributor+ SQLi to Reflected XSS
Fixed in
Fixed in 6.5.1
CVSS
7.1 (high)
Published
2024-01-02
Title
WP SMS < 6.5.1 - Cross-Site Request Forgery to Subscriber Deletion
Fixed in
Fixed in 6.5.1
CVSS
4.3 (medium)
Published
2023-07-07
Title
WP SMS < 6.2.0 - User Unsubscribe via CSRF
Fixed in
Fixed in 6.2.0
CVSS
4.3 (medium)
Published
2023-05-15
Title
WP SMS < 6.1.5 - Reflected XSS
Fixed in
Fixed in 6.1.5
CVSS
7.1 (high)
Published
2023-03-02
Title
WP SMS < 6.0.4.1 - Information Disclosure via REST API
Fixed in
Fixed in 6.0.4.1
CVSS
5.3 (medium)
Published
2021-07-26
Title
WP SMS < 5.4.13 - Authenticated Stored Cross-Site Scripting
Fixed in
Fixed in 5.4.13
CVSS
3.5 (low)
Published
2021-06-30
Title
WP SMS < 5.4.9.1 - Reflected Cross-Site Scripting (XSS)
Fixed in
Fixed in 5.4.9.1
CVSS
7.1 (high)