SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery

Vulnerabilities

• CVE-2026-66424unauthenticated≤ 3.9.7

  WordPress SMS Alert Order Notifications plugin <= 3.9.7 - Privilege Escalation vulnerability

  Critical 9.8

• CVE-2026-15014unauthenticated≤ 3.9.7

  SMS Alert <= 3.9.7 - Unauthenticated Authentication Bypass to Account Takeover via 'billing_phone' Parameter

  Critical 9.8

• CVE-2026-59540unauthenticated≤ 3.9.6

  WordPress SMS Alert Order Notifications plugin <= 3.9.6 - Privilege Escalation vulnerability

  Critical 9.8

• CVE-2026-11387unauthenticated≤ 3.9.5

  SMS Alert <= 3.9.5 - Unauthenticated Privilege Escalation via Arbitrary Password Reset

  Critical 9.8

• CVE-2025-47682unauthenticated≤ 3.8.1

  WordPress SMS Alert Order Notifications – WooCommerce plugin <= 3.8.1 - SQL Injection Vulnerability

  Critical 9.8

• CVE-2024-13553unauthenticated≤ 3.7.9

  SMS Alert Order Notifications – WooCommerce <= 3.7.9 - Unauthenticated Account Takeover/Privilege Escalation

  Critical 9.8

• CVE-2026-54803subscriber+≤ 3.9.4

  WordPress SMS Alert Order Notifications plugin <= 3.9.4 - Privilege Escalation vulnerability

  Critical 9.8

• CVE-2025-49915unauthenticated≤ 3.8.5

  WordPress SMS Alert Order Notifications plugin <= 3.8.5 - SQL Injection vulnerability

  Critical 9.3

• CVE-2026-62106subscriber+≤ 3.9.9

  WordPress SMS Alert Order Notifications plugin <= 3.9.9 - Privilege Escalation vulnerability

  High 8.8

• CVE-2025-3876subscriber+≤ 3.8.1

  SMS Alert Order Notifications – WooCommerce <= 3.8.1 - Authenticated (Subscriber+) Privilege Escalation via handleWpLoginCreateUserAction Function

  High 8.8

• CVE-2024-11725subscriber+≤ 3.7.6

  SMS Alert Order Notifications – WooCommerce <= 3.7.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update

  High 8.8

• CVE-2026-54802unauthenticated≤ 3.9.3

  WordPress SMS Alert Order Notifications plugin <= 3.9.3 - Broken Authentication vulnerability

  High 7.5

• CVE-2025-26988unauthenticated≤ 3.7.8

  WordPress SMS Alert Order Notifications – WooCommerce plugin <= 3.7.8 - SQL Injection vulnerability

  High 7.5

• CVE-2025-26984unauthenticated · needs a click≤ 3.7.8

  WordPress SMS Alert Order Notifications – WooCommerce plugin <= 3.7.8 - Reflected Cross Site Scripting (XSS) vulnerability

  Medium 6.1

• CVE-2026-32373login required≤ 3.9.0

  WordPress SMS Alert Order Notifications plugin <= 3.9.0 - Broken Access Control vulnerability

  Medium 5.4

• CVE-2025-3878contributor+≤ 3.8.1

  SMS Alert Order Notifications – WooCommerce <= 3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via sa_verify Shortcode

  Medium 5.4

• CVE-2024-10233contributor+≤ 3.7.5

  SMSAlert - WooCommerce <= 3.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via sa_subscribe Shortcode

  Medium 5.4

• CVE-2025-66086unauthenticated≤ 3.8.8

  WordPress SMS Alert Order Notifications plugin <= 3.8.8 - Broken Access Control vulnerability

  Medium 5.3

• CVE-2026-15671admin≤ 3.9.7

  SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'id' Parameter

  Medium 4.9

• CVE-2026-15670admin≤ 3.9.7

  SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter

  Medium 4.9

• CVE-2026-15673admin≤ 3.9.7

  SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'checkout_payment_plans' and 'order_status' Settings

  Medium 4.4

• CVE-2024-1489unauthenticated · needs a click≤ 3.6.9

  SMS Alert Order Notifications – WooCommerce <= 3.6.9 - Cross-Site Request Forgery

  Medium 4.3