Unknown Sms Alert vulnerabilities

4 CVEs affecting Unknown Sms Alert, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-94257, published 2026-10-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-15206, published 2026-08-02. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that was actually verified: after an attacker verifies an OTP sent to their own…
CVE-2026-94257, published 2026-10-10. High severity, CVSS 8.1. EPSS: 0.2% chance of exploitation in the next 30 days. The SMS Alert WordPress plugin before 4.0.1 does not bind the account whose password is being changed to the phone number that was actually verified during its OTP password reset, allowing…
CVE-2026-94256, published 2026-10-10. High severity, CVSS 8.1. EPSS: 0.2% chance of exploitation in the next 30 days. The SMS Alert WordPress plugin before 4.0.1 does not verify that the account being logged in is the one the verified one-time code belongs to, allowing unauthenticated attackers to sign in as any…
CVE-2026-94258, published 2026-10-08. Low severity, CVSS 2.7. EPSS: 0.2% chance of exploitation in the next 30 days. The SMS Alert WordPress plugin before 4.0.1 does not check that the acting administrator is allowed to manage the selected users before returning their stored billing phone numbers, allowing an…