Textme Sms Integration Vulnerabilities

The TextMe SMS plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the tetxme_update_option_page() and textme_update_account() functions in all versions up to, and including, 1.9.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

CVSS:

6.5

Affected:

up to 1.9.1

Fixed in:

1.9.2

Disclosed:

Apr 3, 2025

CVE-2025-31789 on NVD →

The TextMe SMS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tetxme_update_option_page() function called via AJAX in all versions up to, and including, 1.9.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to...

CVSS:

4.3

Affected:

up to 1.9.0

Fixed in:

1.9.1

Disclosed:

Nov 23, 2023

CVE-2023-48287 on NVD →

The TextMe SMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions up to, and including, 1.8.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenev...

CVSS:

7.4

Affected:

up to 1.8.9

Fixed in:

1.8.9

Disclosed:

Aug 24, 2021