Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery — Vulnerabilities & Security Advisories 11

All 11 CVE vulnerabilities found in SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery, with AI-generated Chinese analysis, references, and POCs.

Vendor: cozyvision1

CVE IDTitleCVSSSeverityPublished
CVE-2026-15670 SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter CWE-89 4.9 Medium2026-07-28
CVE-2026-15673 SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'checkout_payment_plans' and 'order_status' Settings CWE-89 4.4 Medium2026-07-28
CVE-2026-15671 SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'id' Parameter CWE-89 4.9 Medium2026-07-28
CVE-2026-15014 SMS Alert <= 3.9.7 - Unauthenticated Authentication Bypass to Account Takeover via 'billing_phone' Parameter CWE-288 9.8 Critical2026-07-28
CVE-2026-11387 SMS Alert <= 3.9.5 - Unauthenticated Privilege Escalation via Arbitrary Password Reset CWE-287 9.8 Critical2026-07-01
CVE-2025-3876 SMS Alert Order Notifications – WooCommerce <= 3.8.1 - Authenticated (Subscriber+) Privilege Escalation via handleWpLoginCreateUserAction Function CWE-862 8.8 High2025-05-10
CVE-2025-3878 SMS Alert Order Notifications – WooCommerce <= 3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via sa_verify Shortcode CWE-79 6.4 Medium2025-05-10
CVE-2024-13553 SMS Alert Order Notifications – WooCommerce <= 3.7.9 - Unauthenticated Account Takeover/Privilege Escalation CWE-288 9.8 Critical2025-04-01
CVE-2024-11725 SMS Alert Order Notifications – WooCommerce <= 3.7.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update CWE-862 8.8 High2025-01-07
CVE-2024-10233 SMSAlert - WooCommerce <= 3.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via sa_subscribe Shortcode CWE-79 6.4 Medium2024-10-29
CVE-2024-1489 SMS Alert Order Notifications – WooCommerce <= 3.6.9 - Cross-Site Request Forgery CWE-352 4.3 Medium2024-03-13

All 11 known CVE vulnerabilities affecting SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery with full Chinese analysis, references, and POCs where available.