Login Request a demo
WS
Product
WP SMS
by VeronaLabs · last CVE Jun 15, 2026
14
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities14In the news0Timeline
Severity mix
Critical 1High 3Medium 10Low 0
Severity
All severities14Critical1High3Medium10Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add WP SMS to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2024-43331
9.8
0%
Aug 22
WordPress WP SMS plugin <= 6.9.3 - Broken Access Control vulnerability
Affected: through 6.9.3
CVE-2024-30454
8.8
0%
Mar 29
WordPress WP SMS plugin <= 6.6.2 - Cross Site Request Forgery (CSRF) vulnerability
Affected: through 6.6.2
CVE-2026-28136
7.6
0%
Feb 26
WordPress WP SMS plugin <= 6.9.12 - SQL Injection vulnerability
Affected: through 6.9.12
CVE-2023-27447
7.5
1%
Dec 28
WordPress WP SMS Plugin <= 6.0.4 is vulnerable to Sensitive Data Exposure
Affected: before 6.0.4.1
CVE-2026-40790
6.5
0%
Jun 15
WordPress WP SMS plugin <= 7.2.1 - Sensitive Data Exposure vulnerability
Affected: through 7.2.1
CVE-2024-24881
6.1
0%
Feb 8
WordPress WP SMS Plugin <= 6.5.2 is vulnerable to Cross Site Scripting (XSS)
Affected: before 6.5.3
CVE-2023-32742
6.1
0%
Aug 30
WordPress WP SMS Plugin <= 6.1.4 is vulnerable to Cross Site Scripting (XSS)
Affected: through 6.1.4
CVE-2026-25343
5.9
0%
Feb 19
WordPress WP SMS plugin <= 7.1 - Cross Site Scripting (XSS) vulnerability
Affected: through 7.1
CVE-2025-62006
5.4
0%
Oct 22
WordPress WP SMS plugin <= 7.0.1 - Broken Access Control vulnerability
Affected: through 7.0.1
CVE-2024-25920
5.4
0%
Mar 27
WordPress WP SMS plugin <= 6.3.4 - Cross Site Scripting (XSS) vulnerability
Affected: through 6.3.4
CVE-2021-24561
5.4
1%
Aug 23
The WP SMS WordPress plugin before 5.4.13 does not sanitise the "wp_group_name" parameter before outputting it back in the "Groups" page, leading to an Authenticated Stored…
Affected: before 5.4.13
CVE-2023-6981
4.9
0%
Jan 3
WP SMS <= 6.5 - Authenticated (Admin+) SQL Injection to Reflected Cross-Site Scripting
Affected: before 6.5.1
CVE-2024-34811
4.8
0%
May 13
WordPress WP SMS plugin <= 6.5.1 - Cross Site Scripting (XSS) vulnerability
Affected: through 6.5.1
CVE-2023-6980
4.3
0%
Jan 3
WP SMS <= 6.5 - Cross-Site Request Forgery to Subscriber Deletion
Affected: before 6.5.1
Showing 14