WP Vulnerability WatchVulnerability data as of September 7, 2026

Known vulnerabilities in SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery

Send WooCommerce SMS notifications, COD OTP verification, Login with OTP, abandoned cart recovery, order updates to customers & admins.

21Reported vulnerabilities
9.8Highest CVSS score
3.9.8Latest version
3,000+Active installs

What to do now

Update SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery to 3.9.8 or later. 21 of these have a fixed version available. Updating resolves them.

Plugin last updated: July 27, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVESeverityExploit probability
next 30 days		 Affected versionsFixed inPublished
CVE-2026-11387 Critical 9.8 2.2% 0 to 3.9.5 (inclusive) 3.9.6 July 1, 2026
CVE-2026-15206 Critical 9.8 0.3% Before 3.9.8 3.9.8 August 24, 2026
CVE-2026-15014 Critical 9.8 0.5% 0 to 3.9.7 (inclusive) 3.9.8 July 28, 2026
CVE-2026-59540 Critical 9.8 0.5% 3.9.6 and earlier 3.9.7 July 22, 2026
CVE-2024-13553 Critical 9.8 0.5% 3.7.9 and earlier 3.8.0 March 31, 2025
CVE-2025-3876 High 8.8 0.4% 0 to 3.8.1 (inclusive) 3.8.2 May 10, 2025
CVE-2024-11725 High 8.8 0.5% 0 to 3.7.6 (inclusive) 3.7.7 January 7, 2025
CVE-2025-26988 High 7.5 0.5% 3.7.8 and earlier 3.7.9 March 2, 2025
CVE-2025-49915 High 7.5 0.5% 3.8.5 and earlier 3.8.6 August 15, 2025
CVE-2025-47682 High 7.5 0.4% 3.8.1 and earlier 3.8.2 May 8, 2025
CVE-2026-66424 High 7.3 0.3% 3.9.7 and earlier 3.9.8 August 6, 2026
CVE-2026-54803 Medium 6.3 0.4% 3.9.4 and earlier 3.9.5 June 16, 2026
CVE-2025-26984 Medium 6.1 0.3% 3.7.8 and earlier 3.7.9 February 23, 2025
CVE-2025-3878 Medium 5.4 0.3% 0 to 3.8.1 (inclusive) 3.8.2 May 10, 2025
CVE-2024-10233 Medium 5.4 0.3% 0 to 3.7.5 (inclusive) 3.7.6 October 29, 2024
CVE-2026-54802 Medium 5.3 0.4% 3.9.3 and earlier 3.9.4 June 16, 2026
CVE-2025-66086 Medium 5.3 0.2% 3.8.8 and earlier 3.8.9 December 5, 2025
CVE-2026-15671 Medium 4.9 0.3% 0 to 3.9.7 (inclusive) 3.9.8 July 28, 2026
CVE-2026-15670 Medium 4.9 0.3% 0 to 3.9.7 (inclusive) 3.9.8 July 28, 2026
CVE-2026-15673 Medium 4.4 0.3% 0 to 3.9.7 (inclusive) 3.9.8 July 28, 2026
CVE-2026-32373 Medium 4.3 0.2% 3.9.0 and earlier 3.9.1 February 18, 2026

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.