SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery

SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery has 29 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2026; all 29 are fixed as of October 2026. Their average CVSS score is 6.9, and the most serious one scores 9.8 out of 10. Severity breakdown: 6 critical and 8 high. 2026 was the busiest year with 17 disclosures.

The most common weakness is Missing Authorization, behind 6 of the records (21%). Other recurring categories include SQL Injection, Improper Privilege Management.

Every one of the 29 issues recorded for SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery has a vendor fix available, so running the current release closes all known holes.

22 independent researchers contributed these findings, most of them (3) reported by benzdeus. SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery is installed on roughly 3,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

01234567891018.12.2016Today02.08.20216.1SMS Alert Order Notifications – WooCommerce <= 3.4.6 - Cross-Site Scripting CVSS 6.1 · 02.08.202126.02.20244.3SMS Alert Order Notifications – WooCommerce <= 3.6.9 - Cross-Site Request Forgery CVSS 4.3 · 26.02.202428.10.20246.4SMSAlert - WooCommerce <= 3.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via sa_subscribe Shortcode CVSS 6.4 · 28.10.202406.01.20258.8SMS Alert Order Notifications – WooCommerce <= 3.7.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update CVSS 8.8 · 06.01.202523.02.20256.1SMS Alert Order Notifications – WooCommerce <= 3.7.8 - Reflected Cross-Site Scripting CVSS 6.1 · 23.02.202502.03.20257.5SMS Alert Order Notifications – WooCommerce <= 3.7.8 - Unauthenticated SQL Injection CVSS 7.5 · 02.03.202531.03.20259.8SMS Alert Order Notifications – WooCommerce <= 3.7.9 - Unauthenticated Account Takeover/Privilege Escalation CVSS 9.8 · 31.03.202508.05.20257.5SMS Alert Order Notifications – WooCommerce <= 3.8.1 - Unauthenticated SQL Injection CVSS 7.5 · 08.05.202509.05.20256.4SMS Alert Order Notifications – WooCommerce <= 3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via sa_verify Shortcode CVSS 6.4 · 09.05.20258.8SMS Alert Order Notifications – WooCommerce <= 3.8.1 - Authenticated (Subscriber+) Privilege Escalation via handleWpLoginCreateUserAction Function CVSS 8.8 · 09.05.202515.08.20257.5SMS Alert Order Notifications <= 3.8.5 - Unauthenticated SQL Injection CVSS 7.5 · 15.08.202505.12.20255.3SMS Alert Order Notifications <= 3.8.8 - Missing Authorization CVSS 5.3 · 05.12.202518.02.20264.3SMS Alert Order Notifications <= 3.9.0 - Missing Authorization CVSS 4.3 · 18.02.202616.06.20266.3SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery <= 3.9.4 - Authenticated (Subscriber+) Privilege Escalation CVSS 6.3 · 16.06.20265.3SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery <= 3.9.3 - Missing Authorization CVSS 5.3 · 16.06.202630.06.20269.8SMS Alert <= 3.9.5 - Unauthenticated Privilege Escalation via Arbitrary Password Reset CVSS 9.8 · 30.06.202622.07.20269.8SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery <= 3.9.6 - Unauthenticated Privilege Escalation CVSS 9.8 · 22.07.202627.07.20264.9SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'id' Parameter CVSS 4.9 · 27.07.20269.8SMS Alert <= 3.9.7 - Unauthenticated Authentication Bypass to Account Takeover via 'billing_phone' Parameter CVSS 9.8 · 27.07.20264.4SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'checkout_payment_plans' and 'order_status' Settings CVSS 4.4 · 27.07.20264.9SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter CVSS 4.9 · 27.07.202606.08.20267.3SMS Alert Order Notifications <= 3.9.7 - Unauthenticated Privilege Escalation CVSS 7.3 · 06.08.202624.08.20269.8SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery < 3.9.8 - Authentication Bypass via Account Takeover CVSS 9.8 · 24.08.202611.09.20266.3SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery <= 3.9.9 - Authenticated (Subscriber+) Privilege Escalation CVSS 6.3 · 11.09.202605.10.20267.3SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery <= 4.0.0 - Unauthenticated Privilege Escalation CVSS 7.3 · 05.10.202608.10.20262.7SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery 3.6.4 - 4.0.0 - Authenticated (Administrator+) Information Exposure CVSS 2.7 · 08.10.20269.8SMS Alert <= 4.0.0 - Unauthenticated Arbitrary Account Takeover CVSS 9.8 · 08.10.20267.3SMS Alert 3.9.6 - 4.0.0 - Unauthenticated Privilege Escalation CVSS 7.3 · 08.10.202615.10.20264.3SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery <= 4.0.1 - Missing Authorization CVSS 4.3 · 15.10.2026

Strategic Overview

Avg CVSSMedium
6.9/ 10
Patch Coverage100%
Open

0

Fixed

29

Get automatic notifications for all SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2026-94256

SMS Alert <= 4.0.0 - Unauthenticated Arbitrary Account Takeover

Read the full analysis

Vulnerability Records

29 records
2026-10-15 18:20CVE-2026-110882
4.3
Medium
Khubab AhmedYes
2026-10-08 00:00CVE-2026-94258
2.7
Low
Muni Nitish Kumar YaddalaYes
2026-10-08 00:00CVE-2026-94256
9.8
Critical
Raphael P. CiganaYes
2026-10-08 00:00CVE-2026-94257
7.3
High
Raphael P. CiganaYes
2026-10-05 11:21CVE-2026-95594
7.3
High
Peter TangYes
2026-09-11 00:00CVE-2026-62106
6.3
Medium
benzdeusYes
2026-08-24 00:00CVE-2026-15206
9.8
Critical
Sai Praneeth KotiYes
2026-08-06 00:00CVE-2026-66424
7.3
High
Aydan ArabadzhaYes
2026-07-27 18:24CVE-2026-15670
4.9
Medium
Wordfence PRISMYes
2026-07-27 18:23CVE-2026-15673
4.4
Medium
Wordfence PRISMYes
Showing 1–10 of 29 reports
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery banner
Latestv4.0.2

SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery

Cozy Vision Technologies Pvt. Ltd.

Author

Cozy Vision Technologies Pvt. Ltd.

4.6(35)
92/100
Last Updated
2026-10-08 (21d ago)
Active Installs
3,000+
Downloads
320,127
Requires WP
4.6+
Requires PHP
5.6+
Tested up to
WP 7.1.3
Created
2016-12-18 (10y ago)

SMS Alert is an all-in-one SMS and OTP plugin for WooCommerce. Send automatic order status SMS to customers and admins, verify buyers with a one-time password (including OTP for Cash on Delivery orders only), let customers log in or register with OTP, recover abandoned carts by SMS, and tell shoppers when a product is back in stock. It also works without WooCommerce: add SMS notifications and mobile number OTP verification to popular form builders, booking plugins, membership and LMS plugins. What store owners use it for Reduce fake COD orders – ask for OTP verification only on Cash on Delivery orders. Recover lost sales – send automated abandoned cart reminder SMS. Keep customers informed – SMS for every order status, from new order to delivered. Secure logins and signups – Login with OTP, Registration with OTP and Reset Password with OTP. Stay on top of stock – low stock alerts for admins and back-in-stock alerts for customers. Run multivendor stores – notify vendors and verify their numbers at signup. An SMS Alert account is required This plugin sends messages through the SMS Alert SMS gateway, and it works only with that gateway. The plugin is free. SMS credits are purchased from SMS Alert. New accounts include free demo credits so you can test before buying. See the “External Services” section below for what data is sent. Setup video WooCommerce Order SMS Notifications SMS alerts for new orders and every order status Separate templates for customers and admins Custom SMS templates with dynamic order variables and custom order meta Send a custom SMS to a customer directly from the order page (useful for delays, disputes or claims) Notifications for refunds and partial refunds Works with shipment tracking plugins to send delivery updates WooCommerce OTP Verification (Checkout, COD, Login, Registration) OTP to confirm orders at checkout OTP only for selected payment methods, such as Cash on Delivery OTP verification after the order is placed Login with OTP (including optional admin login with OTP) Registration with OTP and Signup with Mobile Reset password with OTP Role-based OTP verification Limit OTP resend attempts Restrict OTP verification to selected countries Country code selector, configurable OTP popup styles, or OTP on the page instead of a popup Delivery OTP: verify the order with an OTP at delivery (with Delivery Drivers for WooCommerce) Abandoned Cart Recovery SMS Capture abandoned carts automatically Send reminder SMS with a link back to the cart Track recovery performance Compatible with block-based WooCommerce checkout No server cron setup required Stock & Inventory Alerts Low stock and out of stock alerts to admins (and to vendors in multivendor stores) Back-in-stock “Notify Me” form for customers, with customizable design Campaigns & Customer Sync Sync customers to groups in your SMS Alert dashboard Send SMS campaigns to users, orders, abandoned carts and Notify Me subscribers Daily SMS balance report and low balance alert Blocks, Shortcodes & Elementor Widgets Blocks: Signup With Mobile, Share Cart, Login With OTP Shortcodes for Login with OTP, Signup with OTP, Share Cart and OTP verification on any form Elementor widgets Works with Gutenberg, Divi and Beaver Builder Who it is for WooCommerce stores that want order SMS and COD verification Multivendor marketplaces Booking, appointment and restaurant reservation websites LMS, membership and community websites Indian stores that need DLT compliant transactional SMS (the plugin also supports sending to multiple countries) Integrations SMS Alert integrates with 50+ plugins. Full setup guides for each are in the SMS Alert documentation. Highlights: Form builders (notifications and OTP verification): Contact Form 7, WPForms, Fluent Forms, Gravity Forms, Ninja Forms, Elementor Forms, Formidable Forms, Forminator, Everest Forms, WS Form, Form Maker. Notifications only: MetForm, JetFormBuilder. Membership, LMS and registration: UsersWP, LearnPress, ARMember, Paid Memberships Pro, MemberMouse, Ultimate Member, Profile Builder, Pie Register, User Registration, RegistrationMagic, BuddyPress, New User Approve, WP-Members. Booking and appointments: WooCommerce Bookings, Booking Calendar, Bookit, Easy Appointments, Amelia, Simply Schedule Appointments, Salon Booking System, Booknetic, gAppointments, Quick Restaurant Reservation, Five Star Restaurant Reservations. CRM and automation: FluentCRM, WP ERP, Jetpack CRM, Uncanny Automator, Groundhogg, WP Fusion. Multivendor, marketplace and WooCommerce extensions: Dokan, MultiVendorX, WooCommerce Product Vendors, WooCommerce Subscriptions, Delivery Drivers for WooCommerce, WP Loyalty, TeraWallet, Returns and Warranty Requests, Return Refund and Exchange for WooCommerce, Local Pickup Plus, WooCommerce Simple Auctions, WooCommerce Serial Numbers, Order Delivery Date, PDF Invoices & Packing Slips. Shipment tracking: WooCommerce Shipment Tracking, Advanced Shipment Tracking, AfterShip. Other: Easy Digital Downloads, Events Manager, WP Travel Engine, Awesome Support, Affiliates Manager, WPAdverts, WPCafe, Sequential Order Numbers Pro, WooCommerce Order Status Manager, Admin Custom Order Fields, WooCommerce Multi-Step Checkout, Claim GST for WooCommerce, Raffle Ticket Generator. Developer friendly Hooks let you send SMS programmatically, modify SMS content before sending, read the SMS Alert API response and extend WooCommerce SMS triggers. See the FAQ for examples. Translations Compatible with WPML and Loco Translate. Help translate the plugin at translate.wordpress.org. Support Email: support@cozyvision.com WordPress support forum Documentation External Services This plugin connects to the SMS Alert service (https://www.smsalert.co.in), operated by Cozy Vision Technologies Pvt. Ltd., to send SMS and OTP messages. The plugin cannot send messages without an SMS Alert account. Data sent to SMS Alert and when: * When you save or verify your settings: your SMS Alert account credentials, to authenticate with the service. * Each time an SMS or OTP is triggered (order status change, OTP request, abandoned cart reminder, back-in-stock alert, form submission, and so on): the recipient mobile number, message text and sender ID. * When campaigns or customer sync are enabled: customer name and mobile number, sent to groups in your SMS Alert dashboard. * When viewing account information in settings: requests for your SMS balance and the list of countries available to your account. Terms of Service: https://kb.smsalert.co.in/tos/ Privacy Policy: https://kb.smsalert.co.in/privacy/

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C