What’s Vulnerable › Products

cozyvision1 SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery vulnerabilities

18 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 15 published in the last 12 months.

Check whether your cozyvision1 SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery version is affected

Latest cozyvision1 SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery vulnerabilities

• CVE-2026-15673 — SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'checkout_payment_plans' and 'order_status' Settings (CVSS 4.4)
• CVE-2026-15671 — SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'id' Parameter (CVSS 4.9)
• CVE-2026-15670 — SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter (CVSS 4.9)
• CVE-2026-15014 — SMS Alert <= 3.9.7 - Unauthenticated Authentication Bypass to Account Takeover via 'billing_phone' Parameter (CVSS 9.8)
• CVE-2026-11387 — SMS Alert <= 3.9.5 - Unauthenticated Privilege Escalation via Arbitrary Password Reset (CVSS 9.8)
• CVE-2026-32373 — WordPress SMS Alert Order Notifications plugin <= 3.9.0 - Broken Access Control vulnerability (CVSS 5.4)
• CVE-2025-66086 — WordPress SMS Alert Order Notifications plugin <= 3.8.8 - Broken Access Control vulnerability (CVSS 5.3)
• CVE-2025-49915 — WordPress SMS Alert Order Notifications plugin <= 3.8.5 - SQL Injection vulnerability (CVSS 9.3)
• CVE-2025-47682 — WordPress SMS Alert Order Notifications – WooCommerce plugin <= 3.8.1 - SQL Injection Vulnerability (CVSS 9.8)
• CVE-2025-3878 — SMS Alert Order Notifications – WooCommerce <= 3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via sa_verify Shortcode (CVSS 5.4)
• CVE-2025-3876 — SMS Alert Order Notifications – WooCommerce <= 3.8.1 - Authenticated (Subscriber+) Privilege Escalation via handleWpLoginCreateUserAction Function (CVSS 8.8)
• CVE-2024-13553 — SMS Alert Order Notifications – WooCommerce <= 3.7.9 - Unauthenticated Account Takeover/Privilege Escalation (CVSS 9.8)
• CVE-2025-26988 — WordPress SMS Alert Order Notifications – WooCommerce plugin <= 3.7.8 - SQL Injection vulnerability (CVSS 7.5)
• CVE-2025-26984 — WordPress SMS Alert Order Notifications – WooCommerce plugin <= 3.7.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 6.1)
• CVE-2024-11725 — SMS Alert Order Notifications – WooCommerce <= 3.7.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update (CVSS 8.8)
• CVE-2024-10233 — SMSAlert - WooCommerce <= 3.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via sa_subscribe Shortcode (CVSS 5.4)
• CVE-2024-1489 — SMS Alert Order Notifications – WooCommerce <= 3.6.9 - Cross-Site Request Forgery (CVSS 4.3)
• CVE-2021-24588 — SMS Alert Order Notifications – WooCommerce < 3.4.7 Authenticated Cross Site Scripting (CVSS 6.1)