Filtered by vendor Wordpress-extensions
Subscriptions
Filtered by product Sms Alert
Subscriptions
Total
2 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-94257 | 1 Wordpress-extensions | 1 Sms Alert | 2026-10-23 | 8.1 High |
| The SMS Alert WordPress plugin before 4.0.1 does not bind the account whose password is being changed to the phone number that was actually verified during its OTP password reset, allowing unauthenticated attackers to set a new password on an arbitrary account, including an administrator, by verifying a one-time code sent to a phone number they control. | ||||
| CVE-2026-94258 | 1 Wordpress-extensions | 1 Sms Alert | 2026-10-09 | 2.7 Low |
| The SMS Alert WordPress plugin before 4.0.1 does not check that the acting administrator is allowed to manage the selected users before returning their stored billing phone numbers, allowing an administrator of one site on a multisite network to disclose the phone numbers of users who belong to other sites on that network. This affects multisite only, and requires the SMS Alert WordPress plugin before 4.0.1's gateway credentials to be stored on the acting administrator's own site. | ||||
Page 1 of 1.