WSMS (formerly WP SMS) – SMS & MMS Notifications with OTP and 2FA for WooCommerce

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 51% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price. A small install base leaves thin data to model from. The recent download trend is too spiky to read.

1. ★★★★★ snowbird2012

   5mo ago

   Support for this plugin was outstanding. Had an install issue, it got dealt with in a direct and no nonsense manner. I have total confidence in any future support I may need for this amazing plugin. Thanks Verona Labs! This topic was modified 2 months ago by snowbird2012.

   Read on wp.org ↗
2. ★★★★★ robertstaddon

   5mo ago

   I’ve been using the Pro version of this plugin for about a year now with Twilio and I’m happy with it. I requested an improvement after the latest update and the support team added it right away!

   Read on wp.org ↗
3. ★★★★★ sjacob7266

   7mo ago

   I have this plugin with the paid add-on for Twilio gateway and Elementor forms and it has been an excellent tool to allow for immediate SMS notification and autoreply as a lead capture for website visitors submitting lead capture forms. More importantly, the developed provides EXCELLENT support when needed. I highly recommend this plugin

   Read on wp.org ↗
4. ★★★★★ kieranhyphen

   8mo ago

   We’ve used this plugin for a while and it has worked fantastically. I recently updated many plugin’s on a clients website, however this caused a problem with the phone number being picked up from CF7. I tried troubleshooting before contacting VeronaLabs. I spoke with a Mr. Gandomi and his help was nothing more than exceptional. If you have any problem implementing this with your website, please contact support before giving up, as I’m sure they’ll be able to help you out.

   Read on wp.org ↗
5. ★★★★★ Hari

   8mo ago

   Refund Received Following Support Escalation ✅I purchased this plugin mainly for OTP-based login using WhatsApp Business Cloud API, but unfortunately it did not meet the advertised functionality.Issues I faced: OTP Login Design LimitationIf a user did not sign up with a phone number in the past, or if their phone number is missing/not updated, there is no mechanism to prompt the user to add or update their phone number after login.This breaks the OTP flow completely and makes it unusable for real-world scenarios. WhatsApp Business Cloud API OTP Not WorkingEven with:Correct Cloud API credentialsApproved Authentication templatesProper configurationThe OTP messages consistently failed. Errors related to template parameters were returned from Meta, and the plugin does not seem to handle these cases correctly. Lack of Clear Support for WhatsApp Authentication TemplatesThe plugin does not clearly support or document how WhatsApp Cloud API Authentication templates should be used. This resulted in repeated failures despite correct setup. Support & RefundI contacted [email protected] requesting cancellation and refund, My email ended up in the spam folder, even though I used Gmail. Since my purchase is covered under the 14-day money-back guarantee mentioned on the website, I expected a response. Unfortunately, there was no reply initially, so I had to contact them via Twitter. After that, they responded and processed my refund.I hope this feedback helps the team improve both the product and support process. This topic was modified 6 months, 1 week ago by Hari. Reason: refund received

   Read on wp.org ↗
6. ★★★★★ abkhi

   8mo ago

   All these claims about the free version support SMS based 2FA. Kind of true . . .UNLESS you happen to use any of the very common SMS Gateways such as Twilio.

   Read on wp.org ↗
7. ★★★★★ paknejad

   1.3y ago

   2fa and otp need premium account

   Read on wp.org ↗
8. ★★★★★ lee879124212

   1.8y ago

   The support for this service is absolutely phenomenal!

   Read on wp.org ↗

Recent releases and news for this plugin

1. 2026-07-30 Version 2.6 New: Added the LogisticSMS gateway New: Added the wpsms_unsubscribe_success_message filter to customize the newsletter unsubscribe confirmation message, with the unsubscribed group passed to the filter for both the unsub 2.6
2. 2026-05-19 Version 2.5 Fix: Fixed missing field placeholder chips in the Quform integration message body. Fix: Fixed [wp_sms_subscriber_form] shortcode showing an empty group list when “Available groups” is blank; it now falls back to all grou 2.5
3. 2026-03-17 Version 2.1 New: Added Contact column to the Two-Way inbox, showing subscriber name or WordPress user display name for each sender. Fix: Fixed gateway initialization issue for 4jawaly, 1s2u, 160au, 0098sms, and 18sms gateways. Fix: 2.1
4. 2026-03-15 Version 2.4 New: Added credit balance support for the GuniSMS gateway. Fix: Updated EaziSMSpro gateway to use the new API endpoint. Fix: Fixed some dashboard strings that were not translatable. Fix: Fixed the “Configure now” link in 2.4
5. 2026-03-09 Version 2.3 New: Added per-page selector to all list pages (Subscribers, Outbox, Groups, Scheduled, Campaigns, Two-Way Inbox), allowing users to choose how many items to display per page. Enhancement: Minor improvements. 2.3
6. 2026-03-09 Version 2.2 Enhancement: Redesigned the phone number migration wizard with a simpler 5-step flow, progress tracking, and improved safety messaging. Enhancement: Added a phone number normalization wizard to standardize numbers for im 2.2

17 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. Medium · 4.3 WSMS (formerly WP SMS) – SMS & MMS Notifications with OTP and 2FA for WooCommerce <= 7.2.1 - Authenticated (Subscriber+) Information Exposure ↗
   2026-04-23 CVE-2026-40790 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 7.2.1 Patched in 7.2.2
2. Medium · 4.4 WSMS (formerly WP SMS) – SMS & MMS Notifications with OTP and 2FA for WooCommerce <= 7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
   2026-02-10 CVE-2026-25343 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 7.1 Patched in 7.1.1
3. Medium · 4.3 WP SMS <= 7.0.1 - Missing Authorization ↗
   2025-10-16 CVE-2025-62006 Missing Authorization Affects <= 7.0.1 Patched in 7.0.2
4. Medium · 4.9 SMS <= 6.9.12 - Authenticated (Administrator+) SQL Injection ↗
   2025-06-14 CVE-2026-28136 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 6.9.12 Patched in 7.0
5. Medium · 5.3 WP SMS <= 6.9.3 - Missing Authorization ↗
   2024-08-16 CVE-2024-43331 Missing Authorization Affects <= 6.9.3 Patched in 6.9.4
6. Medium · 4.4 WP SMS <= 6.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
   2024-05-13 CVE-2024-34811 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 6.5.1 Patched in 6.5.2
7. Medium · 4.3 WP SMS <= 6.6.2 - Cross-Site Request Forgery ↗
   2024-03-28 CVE-2024-30454 Cross-Site Request Forgery (CSRF) Affects <= 6.6.2 Patched in 6.6.3
8. Medium · 6.4 WP SMS <= 6.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗
   2024-02-14 CVE-2024-25920 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 6.3.4 Patched in 6.4
9. Medium · 6.1 WP SMS <= 6.5.2 - Reflected Cross-Site Scripting via 'page' ↗
   2024-02-05 CVE-2024-24881 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 6.5.2 Patched in 6.5.3
10. Medium · 6.4 WP SMS <= 6.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2024-01-12 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 6.5.1 Patched in 6.5.2
11. Medium · 4.3 WP SMS <= 6.5 - Cross-Site Request Forgery to Subscriber Deletion ↗
    2024-01-02 CVE-2023-6980 Cross-Site Request Forgery (CSRF) Affects <= 6.5 Patched in 6.5.1
12. Medium · 6.1 WP SMS <= 6.5 - Authenticated (Admin+) SQL Injection to Reflected Cross-Site Scripting ↗
    2024-01-02 CVE-2023-6981 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 6.5 Patched in 6.5.1
13. Medium · 4.3 WP SMS <= 6.1.5 - Cross-Site Request Forgery ↗
    2023-07-07 Cross-Site Request Forgery (CSRF) Affects < 6.2.0 Patched in 6.2.0
14. Medium · 6.1 WP SMS <= 6.1.4 - Reflected Cross-Site Scripting via 'delete_mobile' ↗
    2023-05-15 CVE-2023-32742 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 6.1.4 Patched in 6.1.5
15. Medium · 5.3 WP SMS <= 6.0.4 - Information Disclosure via REST API ↗
    2023-03-02 CVE-2023-27447 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 6.0.4 Patched in 6.0.4.1
16. Medium · 5.5 WP SMS <= 5.4.12 - Authenticated Stored Cross-Site Scripting ↗
    2021-07-26 CVE-2021-24561 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 5.4.13 Patched in 5.4.13
17. Medium · 6.1 WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc <= 5.4.9 - Reflected Cross-Site Scripting ↗
    2021-06-30 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.4.9 Patched in 5.4.9.1

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

Translated into 81 languages, 0 at 90% or more

Plus 57 more locales with partial translations.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-04-28 8K+ → 7K+ down after 37 days in tier
2. 2026-03-22 9K+ → 8K+ down after 164 days in tier
3. 2025-10-09 10K+ → 9K+ down after 4 days in tier
4. 2025-10-05 9K+ → 10K+ up after 3 days in tier
5. 2025-10-02 10K+ → 9K+ down after 2 days in tier
6. 2025-09-30 9K+ → 10K+ up after 5 days in tier
7. 2025-09-25 10K+ → 9K+ down after 1 days in tier
8. 2025-09-24 9K+ → 10K+ up after 1 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• miniOrange OTP Login, Verification and SMS Notifications 5K+ installs · 4.7★ · 2 shared tags A
• Branded SMS Pakistan 40+ installs · 4.0★ · 2 shared tags B
• SEND SMS in Pakistan — installs · 3.6★ · 2 shared tags D
• SMS For Woo — installs · 3.6★ · 2 shared tags B
• SMS Manager – SMS Notifications for WooCommerce — installs · 3.6★ · 2 shared tags B
• Login & Register Forms – Popup, Slider, Profile & WooCommerce 40K+ installs · 4.7★ · 1 shared tag A

Embed this report card

Drop a live Pulse card for WSMS (formerly WP SMS) – SMS & MMS Notifications with OTP and 2FA for WooCommerce into a readme, a review or a deck. It updates itself.

WSMS (formerly WP SMS) – SMS & MMS Notifications with OTP and 2FA for WooCommerce: 7K+ active installs, 4.1★ (107 reviews). Plugin Pulse (WP Mayor), as of 2026-08-29. https://plugins.wpmayor.com/plugin/wp-sms