Ccozyvision1

Products

Exploited and recent CVEs

• CVE-2026-15673 Medium 4.4 SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'checkout_payment_plans' and 'order_status' Settings 0.5%
• CVE-2026-15670 Medium 4.9 SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter 0.4%
• CVE-2026-15671 Medium 4.9 SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'id' Parameter 0.5%
• CVE-2026-15014 Critical 9.8 SMS Alert <= 3.9.7 - Unauthenticated Authentication Bypass to Account Takeover via 'billing_phone' Parameter 0.9%
• CVE-2026-11387 Critical 9.8 SMS Alert <= 3.9.5 - Unauthenticated Privilege Escalation via Arbitrary Password Reset 2.2%
• CVE-2025-3878 Medium 6.4 SMS Alert Order Notifications – WooCommerce <= 3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via sa_verify Shortcode 0.3%
• CVE-2025-3876 High 8.8 SMS Alert Order Notifications – WooCommerce <= 3.8.1 - Authenticated (Subscriber+) Privilege Escalation via handleWpLoginCreateUserAction Function 0.5%
• CVE-2024-13553 Critical 9.8 SMS Alert Order Notifications – WooCommerce <= 3.7.9 - Unauthenticated Account Takeover/Privilege Escalation 0.5%
• CVE-2024-11725 High 8.8 SMS Alert Order Notifications – WooCommerce <= 3.7.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update 0.5%
• CVE-2024-10233 Medium 6.4 SMSAlert - WooCommerce <= 3.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via sa_subscribe Shortcode 0.4%
• CVE-2024-1489 Medium 4.3 SMS Alert Order Notifications – WooCommerce <= 3.6.9 - Cross-Site Request Forgery 0.2%