OTP Login & Register Woocommerce

OTP Login & Register Woocommerce has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2026; all 4 are fixed as of September 2026. Their average CVSS score is 7.1, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 2 high.

The most common weakness is Cross-Site Scripting, behind 1 of the records (25%). Other recurring categories include Improper Authentication, Missing Authorization.

Every one of the 4 issues recorded for OTP Login & Register Woocommerce has a vendor fix available, so running the current release closes all known holes.

3 independent researchers contributed these findings, one record each. OTP Login & Register Woocommerce is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSHigh

7.1/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all OTP Login & Register Woocommerce vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2024-5324

XootiX Framework <= Various Plugin Versions - Missing Authorization to Arbitrary Options Update

Read the full analysis

Vulnerability Records

4 records


2026-09-10 14:39	OTP Login & Register Woocommerce <= 2.7.2 - Unauthenticated Authentication Bypass via Brute Force OTP Login & Register Woocommerce <= 2.7.2	`CVE-2026-12215`	5.3 Medium	d4ngvn	Yes
2024-06-05 13:11	XootiX Framework <= Various Plugin Versions - Missing Authorization to Arbitrary Options Update OTP Login & Register Woocommerce <= 2.6.1	`CVE-2024-5324`	8.8 High	1337_Wannabe	Yes
2023-05-16 00:00	OTP Login Woocommerce & Gravity Forms <= 2.2 - Authentication Bypass to Privilege Escalation OTP Login & Register Woocommerce <= 2.2	`CVE-2023-2706`	8.1 High	István Márton	Yes
2022-05-26 00:00	OTP Login Woocommerce & Gravity Forms <= 2.0 - Cross-Site Scripting OTP Login & Register Woocommerce <= 2.0	`N/A`	6.1 Medium	Anonymous	Yes

Showing 1–4 of 4 reports

Latestv2.7.4

OTP Login & Register Woocommerce

Author

xootix

4.6(44)

92/100

Last Updated

2026-09-05 (8d ago)

Active Installs

1,000+

Downloads

100,444

Requires WP

3.0.1+

Requires PHP

5.2.4+

Tested up to

WP 7.0.4

Created

2019-12-22 (7y ago)

Live Demo Allow users to login/signup with one time password(OTP) sent on your mobile device. Features And Options: Adds a phone number field to the signup form No need to remember email/password, login with OTP Fully customizable Woocommerce Compatible Fully Ajaxed. Third Party Services This plugin uses third party services to send SMSs SMS Operators available: Firebase ( Free messages ) Twilio Amazon SMS Alert, MSG91, Textlocal, Unifonic and others.. For detecting country code, plugin uses API endpoints for looking up user IP address. This is optional and can be disabled from the settings Options available ipify, ipecho, ident, whatismyipaddress Pro Features: Login with Email OTP. Two Factor Authentication – SMS/Email Validate and verify phone number in checkout form before customer places an order. Register with a single click. Email & Password less registration. Manage registration fields. Popup & inline form design ( Try here) https://wordpress.org/plugins/easy-login-woocommerce/ Show the countries’ flags Documentation Documentation

View on WordPress.org