CVE-2025-3876

CVE-2025-3876 affects SMS Alert Order Notifications – WooCommerce (WordPress). The vulnerability is a Privilege Escalation due to insufficient OTP validation in handleWpLoginCreateUserAction(), affecting all versions up to 3.8.1. Authenticated users with Subscriber+ access can impersonate other a...

CVE-2025-26988

CVE-2025-26988 (WordPress SMS Alert Order Notifications – WooCommerce) Concrete Details: A SQL Injection vulnerability exists in the WordPress plugin SMS Alert Order Notifications – WooCommerce (affected:

CVE-2025-47682

CVE-2025-47682 concerns the WordPress plugin “SMS Alert Order Notifications – WooCommerce” by Cozy Vision Technologies. It is an SQL Injection vulnerability caused by improper neutralization of special elements in SQL queries, affecting versions up to 3.8.2. The CVSS details show a high severity ...

CVE-2025-3878

CVE-2025-3878 | SMS Alert Order Notifications – WooCommerce (WordPress) is vulnerable to Stored Cross-Site Scripting via the plugin’s sa_verify shortcode in all versions up to 3.8.1 due to insufficient input sanitization and output escaping of user-supplied attributes. The vulnerability can be ex...

CVE-2025-26984

CVE-2025-26984 is a Reflected XSS in the WordPress plugin SMS Alert Order Notifications – WooCommerce (vulnerable from n/a through 3.7.8). Public sources classify impact as MEDIUM to HIGH depending on scoring source (NVD CVSSv3.1: 6.1; Patchstack CNA: 7.1). The vulnerability affects The Cozy Visi...

CVE-2021-24588

The WordPress plugin SMS Alert Order Notifications – WooCommerce (versions before 3.4.7) is affected by an authenticated cross-site scripting (XSS) vulnerability in the settings page. CVE-2021-24588 documents an XSS with a CVSS v3.1 base score of 6.1. Remediation: upgrade to version 3.4.7 or late...

CVE-2024-13553

CVE-2024-13553 affects the WordPress plugin SMS Alert Order Notifications – WooCommerce . The vulnerability arises because the plugin uses the Host header to detect a “playground” environment, enabling unauthenticated attackers to spoof the Host header and cause the OTP code to be “1234”, leading...

CVE-2024-11725

CVE-2024-11725 concerns the SMS Alert Order Notifications – WooCommerce WordPress plugin. Wordfence reports a missing capability check in updateWcWarrantySettings() across all versions up to and including 3.7.6, allowing authenticated attackers with subscriber-level access or higher to modify arb...

CVE-2024-1489

CVE-2024-1489 applies to the SMS Alert Order Notifications – WooCommerce plugin for WordPress (versions up to and including 3.6.9). The root cause is missing or incorrect nonce validation in the processBulkAction function, enabling CSRF. This can allow unauthenticated attackers to delete pages an...

CVE-2024-10233

CVE-2024-10233 affects the SMS Alert Order Notifications – WooCommerce WordPress plugin. It is vulnerable in all versions up to and including 3.7.5 due to insufficient input sanitization and output escaping on the sa_subscribe shortcode attributes, enabling an authenticated attacker with contribu...