Skip to content
Noroxi

WSMS (formerly WP SMS) – SMS & MMS Notifications with OTP and 2FA for WooCommerce

wp-sms · plugin

Known security vulnerabilities for WSMS (formerly WP SMS) – SMS & MMS Notifications with OTP and 2FA for WooCommerce. Find out in seconds which version runs on your site with WP Lens.

14 known vulnerabilities

1 critical · 6 exploitable without logging in · latest Jun 15, 2026

Listed on wordpress.org · latest 7.2.9 · last updated Oct 1, 2026 · 7K+ installs

wordpress.org status checked on Oct 2, 2026

Vulnerabilities

  • CVE-2024-43331unauthenticated≤ 6.9.3

    WordPress WP SMS plugin <= 6.9.3 - Broken Access Control vulnerability

    Critical 9.8

  • CVE-2024-30454unauthenticated · needs a click≤ 6.6.2

    WordPress WP SMS plugin <= 6.6.2 - Cross Site Request Forgery (CSRF) vulnerability

    High 8.8

  • CVE-2026-28136high privilege≤ 6.9.12

    WordPress WP SMS plugin <= 6.9.12 - SQL Injection vulnerability

    High 7.6

  • CVE-2023-27447unauthenticated≤ 6.0.4

    WordPress WP SMS Plugin <= 6.0.4 is vulnerable to Sensitive Data Exposure

    High 7.5

  • CVE-2026-40790subscriber+≤ 7.2.1

    WordPress WP SMS plugin <= 7.2.1 - Sensitive Data Exposure vulnerability

    Medium 6.5

  • CVE-2024-24881unauthenticated · needs a click≤ 6.5.2

    WordPress WP SMS Plugin <= 6.5.2 is vulnerable to Cross Site Scripting (XSS)

    Medium 6.1

  • CVE-2023-32742unauthenticated · needs a click≤ 6.1.4

    WordPress WP SMS Plugin <= 6.1.4 is vulnerable to Cross Site Scripting (XSS)

    Medium 6.1

  • CVE-2026-25343high privilege≤ 7.1

    WordPress WP SMS plugin <= 7.1 - Cross Site Scripting (XSS) vulnerability

    Medium 5.9

  • CVE-2025-62006login required≤ 7.0.1

    WordPress WP SMS plugin <= 7.0.1 - Broken Access Control vulnerability

    Medium 5.4

  • CVE-2024-25920login required≤ 6.3.4

    WordPress WP SMS plugin <= 6.3.4 - Cross Site Scripting (XSS) vulnerability

    Medium 5.4

  • CVE-2021-24561login required→ 5.4.13

    WP SMS < 5.4.13 - Authenticated Stored Cross-Site Scripting

    Medium 5.4

  • CVE-2023-6981admin≤ 6.5

    WP SMS <= 6.5 - Authenticated (Admin+) SQL Injection to Reflected Cross-Site Scripting

    Medium 4.9

  • CVE-2024-34811high privilege≤ 6.5.1

    WordPress WP SMS plugin <= 6.5.1 - Cross Site Scripting (XSS) vulnerability

    Medium 4.8

  • CVE-2023-6980unauthenticated · needs a click≤ 6.5

    WP SMS <= 6.5 - Cross-Site Request Forgery to Subscriber Deletion

    Medium 4.3

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory