Sms Alert (Unknown) - vulnerabilities (CVEs)

4 CVEs, 3 in the last 30 days, 1 known versions, newest CVE from 2026-10-10. Vendor: Unknown.

CVEs of Sms Alert

• CVE-2026-94256 - CVSS 8.1 (high), 2026-10-10: The SMS Alert WordPress plugin before 4.0.1 does not verify that the account being logged in is the one the verified one-time code belongs to, allowing…
• CVE-2026-94257 - CVSS 8.1 (high), 2026-10-10: The SMS Alert WordPress plugin before 4.0.1 does not bind the account whose password is being changed to the phone number that was actually verified during…
• CVE-2026-94258 - CVSS 2.7 (low), 2026-10-08: The SMS Alert WordPress plugin before 4.0.1 does not check that the acting administrator is allowed to manage the selected users before returning their stored…
• CVE-2026-15206 - CVSS 7.5 (high), 2026-08-02: The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that was actually verified: after an attacker…