WordPress plugin
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 30 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical6
- High9
- Medium14
- Low1
All SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery vulnerabilities
- High7.3Unauthenticated Privilege Escalation
≤4.0.2Update to 4.0.3
- Medium4.3Missing Authorization
≤4.0.1Update to 4.0.2
- Low2.74.0.0 - Authenticated (Administrator+) Information Exposure
3.6.4 – 4.0.0Update to 4.0.1
- Critical9.8Unauthenticated Arbitrary Account Takeover
≤4.0.0Update to 4.0.1
- High7.34.0.0 - Unauthenticated Privilege Escalation
3.9.6 – 4.0.0Update to 4.0.1
- High7.3Unauthenticated Privilege Escalation
≤4.0.0Update to 4.0.1
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
≤3.9.9Update to 4.0.0
- Critical9.8Authentication Bypass via Account Takeover
<3.9.8Update to 3.9.8
- High7.3Unauthenticated Privilege Escalation
≤3.9.7Update to 3.9.8
- Medium4.9Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
≤3.9.7Update to 3.9.8
- Medium4.4Authenticated (Administrator+) SQL Injection via 'checkout_payment_plans' and 'order_status' Settings
≤3.9.7Update to 3.9.8
- Critical9.8Unauthenticated Authentication Bypass to Account Takeover via 'billing_phone' Parameter
≤3.9.7Update to 3.9.8
- Medium4.9Authenticated (Administrator+) SQL Injection via 'id' Parameter
≤3.9.7Update to 3.9.8
- Critical9.8Unauthenticated Privilege Escalation
≤3.9.6Update to 3.9.7
- Critical9.8Unauthenticated Privilege Escalation via Arbitrary Password Reset
≤3.9.5Update to 3.9.6
- Medium6.3Authenticated (Subscriber+) Privilege Escalation
≤3.9.4Update to 3.9.5
- Medium5.3Missing Authorization
≤3.9.3Update to 3.9.4
- Medium4.3Missing Authorization
≤3.9.0Update to 3.9.1
- Medium5.3Missing Authorization
≤3.8.8Update to 3.8.9
- High7.5Unauthenticated SQL Injection
≤3.8.5Update to 3.8.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via sa_verify Shortcode
≤3.8.1Update to 3.8.2
- High8.8Authenticated (Subscriber+) Privilege Escalation via handleWpLoginCreateUserAction Function
≤3.8.1Update to 3.8.2
- High7.5Unauthenticated SQL Injection
≤3.8.1Update to 3.8.2
- Critical9.8Unauthenticated Account Takeover/Privilege Escalation
≤3.7.9Update to 3.8.0
- High7.5Unauthenticated SQL Injection
≤3.7.8Update to 3.7.9
- Medium6.1Reflected Cross-Site Scripting
≤3.7.8Update to 3.7.9
- High8.8Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
≤3.7.6Update to 3.7.7
- Medium6.4WooCommerce <= 3.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via sa_subscribe Shortcode
≤3.7.5Update to 3.7.6
- Medium4.3Cross-Site Request Forgery
≤3.6.9Update to 3.7.0
- Medium6.1Cross-Site Scripting
<3.4.7Update to 3.4.7
SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery: common questions
Does SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery have known vulnerabilities?
Yes. VulnCrest Radar lists 30 known vulnerabilities in SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery: 6 critical, 9 high, 14 medium, 1 low. None are known to affect version null.
How do I check which version of SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery vulnerability?
CVE-2026-116386, published Oct 30, 2026: SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery <= 4.0.2 - Unauthenticated Privilege Escalation. Severity: High (CVSS 7.3).
Is any SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery vulnerability listed in CISA KEV?
No. None of the known SMS Alert – SMS Notifications & OTP Login, COD Verification, Abandoned Cart Recovery vulnerabilities is currently listed in the CISA KEV catalog.