SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery

Уязвимости

• CVE-2026-66424без авторизации≤ 3.9.7

  WordPress SMS Alert Order Notifications plugin <= 3.9.7 - Privilege Escalation vulnerability

  Критич. 9.8

• CVE-2026-15014без авторизации≤ 3.9.7

  SMS Alert <= 3.9.7 - Unauthenticated Authentication Bypass to Account Takeover via 'billing_phone' Parameter

  Критич. 9.8

• CVE-2026-59540без авторизации≤ 3.9.6

  WordPress SMS Alert Order Notifications plugin <= 3.9.6 - Privilege Escalation vulnerability

  Критич. 9.8

• CVE-2026-11387без авторизации≤ 3.9.5

  SMS Alert <= 3.9.5 - Unauthenticated Privilege Escalation via Arbitrary Password Reset

  Критич. 9.8

• CVE-2025-47682без авторизации≤ 3.8.1

  WordPress SMS Alert Order Notifications – WooCommerce plugin <= 3.8.1 - SQL Injection Vulnerability

  Критич. 9.8

• CVE-2024-13553без авторизации≤ 3.7.9

  SMS Alert Order Notifications – WooCommerce <= 3.7.9 - Unauthenticated Account Takeover/Privilege Escalation

  Критич. 9.8

• CVE-2026-54803подписчик+≤ 3.9.4

  WordPress SMS Alert Order Notifications plugin <= 3.9.4 - Privilege Escalation vulnerability

  Критич. 9.8

• CVE-2025-49915без авторизации≤ 3.8.5

  WordPress SMS Alert Order Notifications plugin <= 3.8.5 - SQL Injection vulnerability

  Критич. 9.3

• CVE-2026-62106подписчик+≤ 3.9.9

  WordPress SMS Alert Order Notifications plugin <= 3.9.9 - Privilege Escalation vulnerability

  Высокий 8.8

• CVE-2025-3876подписчик+≤ 3.8.1

  SMS Alert Order Notifications – WooCommerce <= 3.8.1 - Authenticated (Subscriber+) Privilege Escalation via handleWpLoginCreateUserAction Function

  Высокий 8.8

• CVE-2024-11725подписчик+≤ 3.7.6

  SMS Alert Order Notifications – WooCommerce <= 3.7.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update

  Высокий 8.8

• CVE-2026-54802без авторизации≤ 3.9.3

  WordPress SMS Alert Order Notifications plugin <= 3.9.3 - Broken Authentication vulnerability

  Высокий 7.5

• CVE-2025-26988без авторизации≤ 3.7.8

  WordPress SMS Alert Order Notifications – WooCommerce plugin <= 3.7.8 - SQL Injection vulnerability

  Высокий 7.5

• CVE-2025-26984без авторизации · нужен клик≤ 3.7.8

  WordPress SMS Alert Order Notifications – WooCommerce plugin <= 3.7.8 - Reflected Cross Site Scripting (XSS) vulnerability

  Средний 6.1

• CVE-2026-32373нужен вход≤ 3.9.0

  WordPress SMS Alert Order Notifications plugin <= 3.9.0 - Broken Access Control vulnerability

  Средний 5.4

• CVE-2025-3878участник+≤ 3.8.1

  SMS Alert Order Notifications – WooCommerce <= 3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via sa_verify Shortcode

  Средний 5.4

• CVE-2024-10233участник+≤ 3.7.5

  SMSAlert - WooCommerce <= 3.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via sa_subscribe Shortcode

  Средний 5.4

• CVE-2025-66086без авторизации≤ 3.8.8

  WordPress SMS Alert Order Notifications plugin <= 3.8.8 - Broken Access Control vulnerability

  Средний 5.3

• CVE-2026-15671админ≤ 3.9.7

  SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'id' Parameter

  Средний 4.9

• CVE-2026-15670админ≤ 3.9.7

  SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter

  Средний 4.9

• CVE-2026-15673админ≤ 3.9.7

  SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'checkout_payment_plans' and 'order_status' Settings

  Средний 4.4

• CVE-2024-1489без авторизации · нужен клик≤ 3.6.9

  SMS Alert Order Notifications – WooCommerce <= 3.6.9 - Cross-Site Request Forgery

  Средний 4.3