WSMS (formerly WP SMS) – SMS & MMS Notifications with OTP and 2FA for WooCommerce Security & Risk Analysis

The "wp-sms" v7.2 plugin exhibits a mixed security posture. While the static analysis reveals a relatively small attack surface with no apparent unprotected entry points and a high percentage of SQL queries using prepared statements and properly escaped output, there are underlying concerns. The presence of two instances of the `unserialize` function is a significant red flag, as it can lead to remote code execution if not handled with extreme caution and proper input sanitization. Furthermore, the vulnerability history is concerning, with a total of 15 known medium-severity CVEs. The pattern of past vulnerabilities, including Missing Authorization, CSRF, SQL Injection, XSS, and Information Exposure, suggests a history of significant security weaknesses that require ongoing vigilance. The fact that the last vulnerability was in 2026-02-10 is peculiar given typical vulnerability timelines and might indicate an error in the provided data, but if accurate, it suggests recent attention to patching. The plugin's strengths lie in its defensive coding practices like extensive capability checks and proper output escaping for the most part, but the historical CVEs and the use of `unserialize` introduce notable risks that cannot be overlooked.