SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery

Information

Software Type Plugin
Software Slug sms-alert (view on wordpress.org)
Software Status Active
Software Author cozyvision1
Software Website wordpress.org
Software Downloads 308,906
Software Active Installs 3,000
Software Record Last Updated August 13, 2026

20 Vulnerabilities

Submit a Vulnerability
SMS Alert <= 3.9.7 - Unauthenticated Authentication Bypass to Account Takeover via 'billing_phone' Parameter
9.8
CVE-2026-15014
Jul 27, 2026
Researcher: Civitasmass
SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery <= 3.9.6 - Unauthenticated Privilege Escalation
9.8
CVE-2026-59540
Jul 22, 2026
Researcher: Taylsec
SMS Alert <= 3.9.5 - Unauthenticated Privilege Escalation via Arbitrary Password Reset
9.8
CVE-2026-11387
Jun 30, 2026
Researchers: Chloe Chamberland, Wordfence PRISM
SMS Alert Order Notifications – WooCommerce <= 3.7.9 - Unauthenticated Account Takeover/Privilege Escalation
9.8
CVE-2024-13553
Mar 31, 2025
Researcher: Lucio Sá
SMS Alert Order Notifications – WooCommerce <= 3.8.1 - Authenticated (Subscriber+) Privilege Escalation via handleWpLoginCreateUserAction Function
8.8
CVE-2025-3876
May 9, 2025
Researcher: wesley (wcraft)
SMS Alert Order Notifications – WooCommerce <= 3.7.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
8.8
CVE-2024-11725
Jan 6, 2025
Researcher: 1337_Wannabe
SMS Alert Order Notifications <= 3.8.5 - Unauthenticated SQL Injection
7.5
CVE-2025-49915
Aug 15, 2025
Researcher: ChuongVN
SMS Alert Order Notifications – WooCommerce <= 3.8.1 - Unauthenticated SQL Injection
7.5
CVE-2025-47682
May 8, 2025
Researcher: astra.r3verii
SMS Alert Order Notifications – WooCommerce <= 3.7.8 - Unauthenticated SQL Injection
7.5
CVE-2025-26988
Mar 2, 2025
Researcher: Hakiduck
SMS Alert Order Notifications – WooCommerce <= 3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via sa_verify Shortcode
6.4
CVE-2025-3878
May 9, 2025
Researcher: wesley (wcraft)
SMSAlert - WooCommerce <= 3.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via sa_subscribe Shortcode
6.4
CVE-2024-10233
Oct 28, 2024
Researcher: Peter Thaleikis
SMS Alert Order Notifications – WooCommerce <= 3.7.8 - Reflected Cross-Site Scripting
6.1
CVE-2025-26984
Feb 23, 2025
Researcher: Hakiduck
SMS Alert Order Notifications – WooCommerce <= 3.4.6 - Cross-Site Scripting
6.1
CVE-2021-24588
Aug 2, 2021
Researcher: swapnil subhash bodekar
SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery <= 3.9.3 - Missing Authorization
5.3
CVE-2026-54802
Jun 16, 2026
Researcher: Jakub Herman
SMS Alert Order Notifications <= 3.8.8 - Missing Authorization
5.3
CVE-2025-66086
Dec 5, 2025
Researcher: benzdeus
SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
4.9
CVE-2026-15670
Jul 27, 2026
Researcher: Wordfence PRISM
SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'id' Parameter
4.9
CVE-2026-15671
Jul 27, 2026
Researcher: Wordfence PRISM
SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'checkout_payment_plans' and 'order_status' Settings
4.4
CVE-2026-15673
Jul 27, 2026
Researcher: Wordfence PRISM
SMS Alert Order Notifications <= 3.9.0 - Missing Authorization
4.3
CVE-2026-32373
Feb 18, 2026
Researcher: benzdeus
SMS Alert Order Notifications – WooCommerce <= 3.6.9 - Cross-Site Request Forgery
4.3
CVE-2024-1489
Feb 26, 2024
Researcher: Krzysztof Zając
Title Status CVE ID CVSS Researchers Date
SMS Alert <= 3.9.7 - Unauthenticated Authentication Bypass to Account Takeover via 'billing_phone' Parameter Patched CVE-2026-15014 9.8 Civitasmass July 27, 2026
SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery <= 3.9.6 - Unauthenticated Privilege Escalation Patched CVE-2026-59540 9.8 Taylsec July 22, 2026
SMS Alert <= 3.9.5 - Unauthenticated Privilege Escalation via Arbitrary Password Reset Patched CVE-2026-11387 9.8 Chloe Chamberland, Wordfence PRISM June 30, 2026
SMS Alert Order Notifications – WooCommerce <= 3.7.9 - Unauthenticated Account Takeover/Privilege Escalation Patched CVE-2024-13553 9.8 Lucio Sá March 31, 2025
SMS Alert Order Notifications – WooCommerce <= 3.8.1 - Authenticated (Subscriber+) Privilege Escalation via handleWpLoginCreateUserAction Function Patched CVE-2025-3876 8.8 wesley (wcraft) May 9, 2025
SMS Alert Order Notifications – WooCommerce <= 3.7.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update Patched CVE-2024-11725 8.8 1337_Wannabe January 6, 2025
SMS Alert Order Notifications <= 3.8.5 - Unauthenticated SQL Injection Patched CVE-2025-49915 7.5 ChuongVN August 15, 2025
SMS Alert Order Notifications – WooCommerce <= 3.8.1 - Unauthenticated SQL Injection Patched CVE-2025-47682 7.5 astra.r3verii May 8, 2025
SMS Alert Order Notifications – WooCommerce <= 3.7.8 - Unauthenticated SQL Injection Patched CVE-2025-26988 7.5 Hakiduck March 2, 2025
SMS Alert Order Notifications – WooCommerce <= 3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via sa_verify Shortcode Patched CVE-2025-3878 6.4 wesley (wcraft) May 9, 2025
SMSAlert - WooCommerce <= 3.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via sa_subscribe Shortcode Patched CVE-2024-10233 6.4 Peter Thaleikis October 28, 2024
SMS Alert Order Notifications – WooCommerce <= 3.7.8 - Reflected Cross-Site Scripting Patched CVE-2025-26984 6.1 Hakiduck February 23, 2025
SMS Alert Order Notifications – WooCommerce <= 3.4.6 - Cross-Site Scripting Patched CVE-2021-24588 6.1 swapnil subhash bodekar August 2, 2021
SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery <= 3.9.3 - Missing Authorization Patched CVE-2026-54802 5.3 Jakub Herman June 16, 2026
SMS Alert Order Notifications <= 3.8.8 - Missing Authorization Patched CVE-2025-66086 5.3 benzdeus December 5, 2025
SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter Patched CVE-2026-15670 4.9 Wordfence PRISM July 27, 2026
SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'id' Parameter Patched CVE-2026-15671 4.9 Wordfence PRISM July 27, 2026
SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'checkout_payment_plans' and 'order_status' Settings Patched CVE-2026-15673 4.4 Wordfence PRISM July 27, 2026
SMS Alert Order Notifications <= 3.9.0 - Missing Authorization Patched CVE-2026-32373 4.3 benzdeus February 18, 2026
SMS Alert Order Notifications – WooCommerce <= 3.6.9 - Cross-Site Request Forgery Patched CVE-2024-1489 4.3 Krzysztof Zając February 26, 2024

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation