100 matches found
CVE-2026-15206
CVE-2026-15206 affects the SMS Alert WordPress plugin (before 3.9.8). The vulnerability arises because the plugin does not bind the mobile verified session flag to the actually verified phone number. After an attacker verifies an OTP on their own number, the signup/login handler reads an attacker...
CVE-2026-15206
The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that was actually verified: after an attacker verifies an OTP sent to their own phone, the signup/login handler reads a fresh, attacker-supplied phone number to select the account and...
CVE-2026-15673
The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to generic SQL Injection via 'checkoutpaymentplans' and 'orderstatus' Settings in all versions up to, and including, 3.9.7 due to insufficient escaping on the user supplied...
CVE-2026-15671
The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to generic SQL Injection via the 'id' parameter in all versions up to, and including, 3.9.7 due to insufficient escaping on the user supplied parameter and lack of sufficien...
CVE-2026-15670
The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.9.7 due to insufficient escaping on the user supplied parameter and lack of...
CVE-2026-15673
The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to generic SQL Injection via 'checkoutpaymentplans' and 'orderstatus' Settings in all versions up to, and including, 3.9.7 due to insufficient escaping on the user supplied...
CVE-2026-15673 SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'checkout_payment_plans' and 'order_status' Settings
The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to generic SQL Injection via 'checkoutpaymentplans' and 'orderstatus' Settings in all versions up to, and including, 3.9.7 due to insufficient escaping on the user supplied...
CVE-2026-15673
CVE-2026-15673 affects the WordPress plugin “SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery” up to version 3.9.7. It is a second‑order SQL Injection where insufficient escaping in the update_option‑stored values in checkout_payment_plans and order_status allo...
EUVD-2026-49712
The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to generic SQL Injection via 'checkoutpaymentplans' and 'orderstatus' Settings in all versions up to, and including, 3.9.7 due to insufficient escaping on the user supplied...
CVE-2026-15671
The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to generic SQL Injection via the 'id' parameter in all versions up to, and including, 3.9.7 due to insufficient escaping on the user supplied parameter and lack of sufficien...
CVE-2026-15670
The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to and including 3.9.7, due to insufficient escaping of the user-supplied parameter and inadequate...
CVE-2026-15671
The CVE-2026-15671 entry concerns the WordPress plugin “SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery” (versions ≤ 3.9.7). It describes a generic SQL Injection via the id parameter caused by insufficient escaping and lack of proper query preparation in an ex...
EUVD-2026-49711
The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.9.7 due to insufficient escaping on the user supplied parameter and lack of...
EUVD-2026-49709
The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 3.9.7 via the billingphone parameter. This is due to the processRegistration...
PT-2026-65403
The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 3.9.7 via the billing phone parameter. This is due to the processRegistration...
CVE-2026-59540
The CVE concerns WordPress plugin SMS Alert Order Notifications, affected in versions
CVE-2026-11387 SMS Alert <= 3.9.5 - Unauthenticated Privilege Escalation via Arbitrary Password Reset
The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.9.5. This is due to the plugin not properly validating a user's identity prior to updati...
EUVD-2026-40922
The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.9.5. This is due to the plugin not properly validating a user's identity prior to updati...