VeronaLabs WP SMS vulnerabilities

14 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 4 published in the last 12 months.

Latest VeronaLabs WP SMS vulnerabilities

CVE-2026-40790 — WordPress WP SMS plugin <= 7.2.1 - Sensitive Data Exposure vulnerability (CVSS 6.5)
CVE-2026-28136 — WordPress WP SMS plugin <= 6.9.12 - SQL Injection vulnerability (CVSS 7.6)
CVE-2026-25343 — WordPress WP SMS plugin <= 7.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
CVE-2025-62006 — WordPress WP SMS plugin <= 7.0.1 - Broken Access Control vulnerability (CVSS 5.4)
CVE-2024-43331 — WordPress WP SMS plugin <= 6.9.3 - Broken Access Control vulnerability (CVSS 9.8)
CVE-2024-34811 — WordPress WP SMS plugin <= 6.5.1 - Cross Site Scripting (XSS) vulnerability (CVSS 4.8)
CVE-2024-30454 — WordPress WP SMS plugin <= 6.6.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 8.8)
CVE-2024-25920 — WordPress WP SMS plugin <= 6.3.4 - Cross Site Scripting (XSS) vulnerability (CVSS 5.4)
CVE-2024-24881 — WordPress WP SMS Plugin <= 6.5.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.1)
CVE-2023-6981 — WP SMS <= 6.5 - Authenticated (Admin+) SQL Injection to Reflected Cross-Site Scripting (CVSS 4.9)
CVE-2023-6980 — WP SMS <= 6.5 - Cross-Site Request Forgery to Subscriber Deletion (CVSS 4.3)
CVE-2023-27447 — WordPress WP SMS Plugin <= 6.0.4 is vulnerable to Sensitive Data Exposure (CVSS 7.5)
CVE-2023-32742 — WordPress WP SMS Plugin <= 6.1.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.1)
CVE-2021-24561 — WP SMS < 5.4.13 - Authenticated Stored Cross-Site Scripting (CVSS 5.4)