Skip to content
PluginCanary

WSMS (formerly WP SMS)

WSMS (formerly WP SMS): SMS Notifications, OTP Login and WooCommerce SMS
by VeronaLabs · 7,000+ active installs · Checked 3 Nov 2026
Healthy

Healthy: maintained, last release 2 Nov 2026, 30 releases in 24 months, no unpatched vulnerabilities.

93/ 100 Canary Score
Sub-scores for WSMS (formerly WP SMS)
Ownership100
Maintenance100
Security80
SupportNo data
ReputationNo data

How the score works

Quick answers

Is WSMS (formerly WP SMS) still maintained?
Yes. Last release 2 Nov 2026, 30 releases in the last 24 months. 2 Nov 2026 · wordpress.org
Who owns WSMS (formerly WP SMS), and has it changed hands?
No change recorded. Main committer mostafa.s1990 since Mar 2012. 3 Nov 2026 · SVN log
Was WSMS (formerly WP SMS) removed from wordpress.org?
No. Listed on wordpress.org as of 3 Nov 2026. 3 Nov 2026 · wordpress.org
Is WSMS (formerly WP SMS) safe?
17 known vulnerabilities, all fixed (latest in 7.2.2). Not on the exploited list. 23 Apr 2026 · Wordfence Intelligence
Is the latest WSMS (formerly WP SMS) update safe to install?
No ownership change before 7.2.11. No one-star spike after it. 2 Nov 2026 · Release history

Active signals

Facts we detected, with links to the source.

No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
mostafa.s199012 Mar 2012 to 2 Nov 2026, 468 commits

1 committer recorded. No ownership change since 2012.

Maintenance

Last release
2 days ago
Releases, 24 months
30
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter
Releases per quarter for WSMS (formerly WP SMS)
Q1 202410
Q2 20245
Q3 20245
Q4 20243
Q1 20253
Q2 20250
Q3 20254
Q4 20258
Q1 20263
Q2 20264
Q3 20263
Q4 20263

Last release 2 Nov 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: no reviews. Lifetime: 4.1.

Rating distribution
5 star75
4 star7
3 star6
2 star0
1 star19

Security record

4 vulnerabilities in 24 months (17 on record), all patched (latest fixed in 7.2.2).

Show 17 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
23 Apr 2026WSMS (formerly WP SMS) - SMS & MMS Notifications with OTP and 2FA for WooCommerce <= 7.2.1 - Authenticated (Subscriber+) Information Exposure4.3<= 7.2.17.2.2Patched before disclosure
10 Feb 2026WSMS (formerly WP SMS) - SMS & MMS Notifications with OTP and 2FA for WooCommerce <= 7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting4.4<= 7.17.1.1Patched before disclosure
16 Oct 2025WP SMS <= 7.0.1 - Missing Authorization4.3<= 7.0.17.0.2Patched before disclosure
14 Jun 2025SMS <= 6.9.12 - Authenticated (Administrator+) SQL Injection4.9<= 6.9.127.026
16 Aug 2024WP SMS <= 6.9.3 - Missing Authorization5.3<= 6.9.36.9.46
13 May 2024WP SMS <= 6.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting4.4<= 6.5.16.5.2Patched before disclosure
28 Mar 2024WP SMS <= 6.6.2 - Cross-Site Request Forgery4.3<= 6.6.26.6.3Patched before disclosure
14 Feb 2024WP SMS <= 6.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4<= 6.3.46.4Patched before disclosure
5 Feb 2024WP SMS <= 6.5.2 - Reflected Cross-Site Scripting via 'page'6.1<= 6.5.26.5.3Patched before disclosure
12 Jan 2024WP SMS <= 6.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 6.5.16.5.2Patched before disclosure
2 Jan 2024WP SMS <= 6.5 - Authenticated (Admin+) SQL Injection to Reflected Cross-Site Scripting6.1<= 6.56.5.1Patched before disclosure
2 Jan 2024WP SMS <= 6.5 - Cross-Site Request Forgery to Subscriber Deletion4.3<= 6.56.5.1Patched before disclosure
7 Jul 2023WP SMS <= 6.1.5 - Cross-Site Request Forgery4.3< 6.2.06.2.0Patched before disclosure
15 May 2023WP SMS <= 6.1.4 - Reflected Cross-Site Scripting via 'delete_mobile'6.1<= 6.1.46.1.5Patched before disclosure
2 Mar 2023WP SMS <= 6.0.4 - Information Disclosure via REST API5.3<= 6.0.46.0.4.1Patched before disclosure
26 Jul 2021WP SMS <= 5.4.12 - Authenticated Stored Cross-Site Scripting5.5< 5.4.135.4.13Patched before disclosure
30 Jun 2021WP SMS - Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc <= 5.4.9 - Reflected Cross-Site Scripting6.1<= 5.4.95.4.9.1Patched before disclosure

Changelog mentions of security fixes: 7.2.6 (security); 7.2.11 (security).

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

100% of 1 support threads resolved in the last 2 months.

Momentum

7,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for WSMS (formerly WP SMS)
4 May 2026418
11 May 2026668
18 May 20263,405
25 May 2026996
1 Jun 2026788
8 Jun 2026810
15 Jun 2026744
22 Jun 2026645
29 Jun 2026755
6 Jul 2026712
13 Jul 2026618
20 Jul 2026634
27 Jul 20263,078
3 Aug 20263,889
10 Aug 20261,925
17 Aug 20261,362
24 Aug 2026928
31 Aug 20262,868
7 Sep 20261,497
14 Sep 20261,054
21 Sep 2026844
28 Sep 20263,083
5 Oct 20261,575
12 Oct 20263,183
19 Oct 20261,332
26 Oct 20261,333
2 Nov 20261,975

Weekly downloads over the last 4 weeks are 28% above the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

No healthier plugin in the same category yet.

Facts

Version7.2.11
AuthorVeronaLabs
Added12 Mar 2012
Last updated2 Nov 2026
Active installs7,000+
Requires WordPress4.1
Tested up to7.1.4
Requires PHP7.4
CategoryE-commerce & Shopping
TagsBulk SMS, otp login, woocommerce SMS, sms notifications, 2fa-authentication

Other plugins by this author: WP Statistics - Simple, privacy-friendly Google Analytics alternative, SlimStat Analytics - Real-Time Stats, Heatmaps & Ecommerce, FeedbackBird - Easily Collect Ideas, Issues, and Feedback on WordPress, SpamLens: Jev AI Spam Protection for Comments and Contact Form 7, MonoRanks - AI SEO Audit, AEO and GEO with One-Click Fixes, WConvert - Popup Builder, Email Optin Forms & Lead Capture

Questions

Is WSMS (formerly WP SMS) still maintained?

Yes. Last release 2 Nov 2026, 30 releases in the last 24 months.

Who owns WSMS (formerly WP SMS), and has it changed hands?

No change recorded. Main committer mostafa.s1990 since Mar 2012.

Was WSMS (formerly WP SMS) removed from wordpress.org?

No. Listed on wordpress.org as of 3 Nov 2026.

Is WSMS (formerly WP SMS) safe?

17 known vulnerabilities, all fixed (latest in 7.2.2). Not on the exploited list.

Is the latest WSMS (formerly WP SMS) update safe to install?

No ownership change before 7.2.11. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 3 Nov 2026.Report a data issue