Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-10-30
Sms Alert - Security Vulnerability (CVE-2026-116386)
Unauthenticated Privilege Escalation in SMS Alert Order Notifications
PLUGIN
Sms Alert
CVE-2026-116386
Risk Score
Threat Entry
Updated 2026-11-06
SMS Alert - Security Vulnerability (CVE-2026-94257)
The SMS Alert WordPress plugin before 4.0.1 does not bind the account whose password is being changed to the phone number that was actually verified during its OTP password reset, allowing unauthenticated attackers to set a new password on an arbitrary account, including an administrator, by verifying a one-time code sent to a phone number they control.
PLUGIN
SMS Alert
CVE-2026-94257
Risk Score
Threat Entry
Updated 2026-10-10
SMS Alert - Security Vulnerability (CVE-2026-94256)
The SMS Alert WordPress plugin before 4.0.1 does not verify that the account being logged in is the one the verified one-time code belongs to, allowing unauthenticated attackers to sign in as any user with a stored phone number, including an administrator, by completing a code challenge on a phone they control.
PLUGIN
SMS Alert
CVE-2026-94256
Risk Score
Threat Entry
Updated 2026-10-08
SMS Alert - Security Vulnerability (CVE-2026-94258)
The SMS Alert WordPress plugin before 4.0.1 does not check that the acting administrator is allowed to manage the selected users before returning their stored billing phone numbers, allowing an administrator of one site on a multisite network to disclose the phone numbers of users who belong to other sites on that network. This affects multisite only, and requires the SMS Alert WordPress plugin before 4.0.1's gateway credentials to be stored on the acting administrator's own site.
PLUGIN
SMS Alert
CVE-2026-94258
Risk Score
Threat Entry
Updated 2026-10-12
Sms Alert - Security Vulnerability (CVE-2026-95594)
Incorrect Privilege Assignment vulnerability in Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications sms-alert allows Privilege Escalation.This issue affects SMS Alert Order Notifications: from n/a through 4.0.0.
PLUGIN
Sms Alert
CVE-2026-95594
Risk Score
Threat Entry
Updated 2026-09-11
Sms Alert - Security Vulnerability (CVE-2026-62106)
Subscriber Privilege Escalation in SMS Alert Order Notifications
PLUGIN
Sms Alert
CVE-2026-62106
Risk Score
Threat Entry
Updated 2026-10-24
Sms Alert - Privilege Escalation (CVE-2026-66424)
Unauthenticated Privilege Escalation in SMS Alert Order Notifications
PLUGIN
Sms Alert
CVE-2026-66424
Risk Score
Threat Entry
Updated 2026-08-26
SMS Alert - Security Vulnerability (CVE-2026-15206)
The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that was actually verified: after an attacker verifies an OTP sent to their own phone, the signup/login handler reads a fresh, attacker-supplied phone number to select the account and logs them in. An unauthenticated attacker can therefore log in as any user, including an administrator, who has a billing phone on file.
PLUGIN
SMS Alert
CVE-2026-15206
Risk Score
Threat Entry
Updated 2026-07-28
Sms Alert - SQL Injection (CVE-2026-15673)
The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to generic SQL Injection via 'checkout_payment_plans' and 'order_status' Settings in all versions up to, and including, 3.9.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is…
PLUGIN
Sms Alert
CVE-2026-15673
Risk Score
Threat Entry
Updated 2026-07-28
Sms Alert - Authentication Bypass (CVE-2026-15014)
The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 3.9.7 via the `billing_phone` parameter. This is due to the `processRegistration()` function using a phone-unbound `$_SESSION['sa_mobile_verified']` boolean flag as the sole gate before issuing an authentication cookie — the flag is set to `true` after any successful OTP validation without being bound to the specific phone number that was verified. This makes it possible for unauthenticated…
PLUGIN
Sms Alert
CVE-2026-15014
Risk Score
Threat Entry
Updated 2026-07-28
Sms Alert - SQL Injection (CVE-2026-15671)
The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to generic SQL Injection via the 'id' parameter in all versions up to, and including, 3.9.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Sms Alert
CVE-2026-15671
Risk Score
Threat Entry
Updated 2026-07-28
Sms Alert - SQL Injection (CVE-2026-15670)
The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.9.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
PLUGIN
Sms Alert
CVE-2026-15670
Risk Score
Threat Entry
Updated 2026-07-01
Sms Alert - Privilege Escalation (CVE-2026-11387)
The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.9.5. This is due to the plugin not properly validating a user's identity prior to updating their details like reset the password of any user account, including administrators, and gain full access to those accounts. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's…
PLUGIN
Sms Alert
CVE-2026-11387
Risk Score
Threat Entry
Updated 2026-06-17
Sms Alert - Security Vulnerability (CVE-2026-54802)
Unauthenticated Broken Authentication in SMS Alert Order Notifications
PLUGIN
Sms Alert
CVE-2026-54802
Risk Score
Threat Entry
Updated 2026-06-17
Sms Alert - Broken Access Control (CVE-2026-32373)
Missing Authorization vulnerability in Cozy Vision SMS Alert Order Notifications sms-alert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMS Alert Order Notifications: from n/a through
PLUGIN
Sms Alert
CVE-2026-32373
Risk Score
Threat Entry
Updated 2026-06-17
Sms Alert - Broken Access Control (CVE-2025-66086)
Missing Authorization vulnerability in Cozy Vision SMS Alert Order Notifications sms-alert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMS Alert Order Notifications: from n/a through
PLUGIN
Sms Alert
CVE-2025-66086
Risk Score
Threat Entry
Updated 2026-06-17
Sms Alert - SQL Injection (CVE-2025-49915)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozy Vision SMS Alert Order Notifications sms-alert allows SQL Injection.This issue affects SMS Alert Order Notifications: from n/a through
PLUGIN
Sms Alert
CVE-2025-49915
Risk Score
Threat Entry
Updated 2026-06-17
Sms Alert - Cross-Site Scripting (XSS) (CVE-2025-3878)
The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sa_verify shortcode in all versions up to, and including, 3.8.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Sms Alert
CVE-2025-3878
Risk Score
Threat Entry
Updated 2026-06-17
Sms Alert - Privilege Escalation (CVE-2025-3876)
The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Privilege Escalation due to insufficient user OTP validation in the handleWpLoginCreateUserAction() function in all versions up to, and including, 3.8.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to impersonate any account by supplying its username or email and elevate their privileges to that of an administrator.
PLUGIN
Sms Alert
CVE-2025-3876
Risk Score
Threat Entry
Updated 2026-06-17
Sms Alert - Privilege Escalation (CVE-2024-11725)
The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the updateWcWarrantySettings() function in all versions up to, and including, 3.7.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. Please…
PLUGIN
Sms Alert
CVE-2024-11725
Risk Score