WSMS (formerly WP SMS) – SMS & MMS Notifications with OTP and 2FA for WooCommerce

77 Quality Score

Active Installs

17/30

With 7,000 active installs it sits in the mid-range for SMS plugins, not a household name but well above niche tools like Netgsm at 1,000 installs.

Update Freshness

25/25

The plugin was updated on 2026-05-19 and is tested against WordPress 7.0, which is an exceptionally strong maintenance signal.

User Rating

12/15

An 82 out of 100 from 107 reviewers is a solid user satisfaction score, indicating most users are happy with the experience.

Support Health

8/15

Only 1 support thread exists with a 0.0% resolution rate, so while there is little demand for help, unresolved questions are a yellow flag if you ever need assistance.

WP Compatibility

15/15

It supports WordPress 4.1 through 7.0 and PHP 7.4, giving it the maximum compatibility score in this evaluation.

Scores higher than 56% of indexed plugins

About

Send SMS/MMS notifications, OTP & 2FA messages, and WooCommerce updates with support for multiple gateways and plugin integrations.

Active Installs 7k+

Rating ★★★★ 4.1/5

Last Updated 2026-09-05 6:56am GMT

Requires WordPress 4.1+

Tested Up To 7.1

Requires PHP 7.4+

Security History

17 known vulnerabilities, all patched

17 Medium

Most recent: April 23, 2026

View details ▸

WSMS (formerly WP SMS) – SMS & MMS Notifications with OTP and 2FA for WooCommerce <= 7.2.1 - Authenticated (Subscriber+) Information Exposure Medium

April 23, 2026 Patched in ["7.2.2"] CVE-2026-40790

WSMS (formerly WP SMS) – SMS & MMS Notifications with OTP and 2FA for WooCommerce <= 7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting Medium

February 10, 2026 Patched in ["7.1.1"] CVE-2026-25343

WP SMS <= 7.0.1 - Missing Authorization Medium

October 16, 2025 Patched in ["7.0.2"] CVE-2025-62006

SMS <= 6.9.12 - Authenticated (Administrator+) SQL Injection Medium

June 14, 2025 Patched in ["7.0"] CVE-2026-28136

WP SMS <= 6.9.3 - Missing Authorization Medium

August 16, 2024 Patched in ["6.9.4"] CVE-2024-43331

WP SMS <= 6.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting Medium

May 13, 2024 Patched in ["6.5.2"] CVE-2024-34811

WP SMS <= 6.6.2 - Cross-Site Request Forgery Medium

March 28, 2024 Patched in ["6.6.3"] CVE-2024-30454

WP SMS <= 6.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Medium

February 14, 2024 Patched in ["6.4"] CVE-2024-25920

WP SMS <= 6.5.2 - Reflected Cross-Site Scripting via 'page' Medium

February 5, 2024 Patched in ["6.5.3"] CVE-2024-24881

WP SMS <= 6.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting Medium

January 12, 2024 Patched in ["6.5.2"]

WP SMS <= 6.5 - Cross-Site Request Forgery to Subscriber Deletion Medium

January 2, 2024 Patched in ["6.5.1"] CVE-2023-6980

WP SMS <= 6.5 - Authenticated (Admin+) SQL Injection to Reflected Cross-Site Scripting Medium

January 2, 2024 Patched in ["6.5.1"] CVE-2023-6981

WP SMS <= 6.1.5 - Cross-Site Request Forgery Medium

July 7, 2023 Patched in ["6.2.0"]

WP SMS <= 6.1.4 - Reflected Cross-Site Scripting via 'delete_mobile' Medium

May 15, 2023 Patched in ["6.1.5"] CVE-2023-32742

WP SMS <= 6.0.4 - Information Disclosure via REST API Medium

March 2, 2023 Patched in ["6.0.4.1"] CVE-2023-27447

WP SMS <= 5.4.12 - Authenticated Stored Cross-Site Scripting Medium

July 26, 2021 Patched in ["5.4.13"] CVE-2021-24561

WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc <= 5.4.9 - Reflected Cross-Site Scripting Medium

June 30, 2021 Patched in ["5.4.9.1"]

What It Does

WSMS (formerly WP SMS) routes SMS and MMS messages through your WordPress site, handling WooCommerce order notifications, one-time password logins, and two-factor authentication. It connects to multiple SMS gateways and integrates with other plugins to automate outgoing text alerts and verification codes. In practice, you configure a gateway provider, then enable the notification or auth modules you need.

Who It's For

This plugin fits WooCommerce store owners who want order and shipping updates delivered by SMS, plus site owners who need phone-based login verification or 2FA for member areas. It is also useful for international retailers and subscription services that rely on text messaging for customer engagement and fraud prevention. Small to mid-sized operations with moderate SMS volume will get the most from it.

Who Should Skip It

If you only need basic email-based 2FA or you do not run a WooCommerce store, this plugin is overkill and adds gateway configuration overhead. Sites on hosting that blocks outbound SMS API calls should also avoid it, since delivery will silently fail.

The Bottom Line

WSMS is a well-maintained, broadly compatible SMS and authentication toolkit that earns its 77.02 overall quality score through consistent updates and solid ratings. The weak support track record and modest install base mean you should test your gateway integration carefully before relying on it in production. For WooCommerce stores that need SMS notifications and OTP login in one package, it is a reasonable choice; otherwise, a more specialized alternative may serve you better.

Related Plugins

Pick this if your priority is customizable front-end login and registration forms rather than SMS delivery.

miniOrange OTP Login, Verification and SMS Notifications 78/100

Choose this if you want a broader set of verification methods beyond SMS, including email and social logins, from a dedicated identity vendor.

Two Factor (2FA) Authentication via Email 77/100

Go with this if 2FA is your only need and you would rather not pay for an SMS gateway.

Netgsm 71/100

Pick this if you specifically use the Netgsm gateway in Turkey and want a tighter provider-specific integration.

NotifSMS – SMS Notifications OTP & 2FA for WordPress & WooCommerce 71/100

Choose this if you are locked into Twilio and prefer a gateway-focused alternative with a similar feature set.