WSMS (formerly WP SMS): SMS and OTP for WordPress and WooCommerce

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

151 searches this plugin appeared in over the last 90 days, 20 listed. 116 left out as unrelated or noise (years, numbers, stray words).

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 51% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 6 months ago; a band this size takes about a year or more to cross, which places it about 50% of the way through.

1. ★★★★★ snowbird2012

   7mo ago

   Support for this plugin was outstanding. Had an install issue, it got dealt with in a direct and no nonsense manner. I have total confidence in any future support I may need for this amazing plugin. Thanks Verona Labs! This topic was modified 2 months ago by snowbird2012.

   Read on wp.org ↗
2. ★★★★★ robertstaddon

   8mo ago

   I’ve been using the Pro version of this plugin for about a year now with Twilio and I’m happy with it. I requested an improvement after the latest update and the support team added it right away!

   Read on wp.org ↗
3. ★★★★★ sjacob7266

   9mo ago

   I have this plugin with the paid add-on for Twilio gateway and Elementor forms and it has been an excellent tool to allow for immediate SMS notification and autoreply as a lead capture for website visitors submitting lead capture forms. More importantly, the developed provides EXCELLENT support when needed. I highly recommend this plugin

   Read on wp.org ↗
4. ★★★★★ kieranhyphen

   10mo ago

   We’ve used this plugin for a while and it has worked fantastically. I recently updated many plugin’s on a clients website, however this caused a problem with the phone number being picked up from CF7. I tried troubleshooting before contacting VeronaLabs. I spoke with a Mr. Gandomi and his help was nothing more than exceptional. If you have any problem implementing this with your website, please contact support before giving up, as I’m sure they’ll be able to help you out.

   Read on wp.org ↗
5. ★★★★★ Hari

   10mo ago

   Refund Received Following Support Escalation ✅I purchased this plugin mainly for OTP-based login using WhatsApp Business Cloud API, but unfortunately it did not meet the advertised functionality.Issues I faced: OTP Login Design LimitationIf a user did not sign up with a phone number in the past, or if their phone number is missing/not updated, there is no mechanism to prompt the user to add or update their phone number after login.This breaks the OTP flow completely and makes it unusable for real-world scenarios. WhatsApp Business Cloud API OTP Not WorkingEven with:Correct Cloud API credentialsApproved Authentication templatesProper configurationThe OTP messages consistently failed. Errors related to template parameters were returned from Meta, and the plugin does not seem to handle these cases correctly. Lack of Clear Support for WhatsApp Authentication TemplatesThe plugin does not clearly support or document how WhatsApp Cloud API Authentication templates should be used. This resulted in repeated failures despite correct setup. Support & RefundI contacted [email protected] requesting cancellation and refund, My email ended up in the spam folder, even though I used Gmail. Since my purchase is covered under the 14-day money-back guarantee mentioned on the website, I expected a response. Unfortunately, there was no reply initially, so I had to contact them via Twitter. After that, they responded and processed my refund.I hope this feedback helps the team improve both the product and support process. This topic was modified 6 months, 1 week ago by Hari. Reason: refund received

   Read on wp.org ↗
6. ★★★★★ abkhi

   10mo ago

   All these claims about the free version support SMS based 2FA. Kind of true . . .UNLESS you happen to use any of the very common SMS Gateways such as Twilio.

   Read on wp.org ↗
7. ★★★★★ paknejad

   1.5y ago

   2fa and otp need premium account

   Read on wp.org ↗
8. ★★★★★ lee879124212

   1.9y ago

   The support for this service is absolutely phenomenal!

   Read on wp.org ↗

Recent releases and news for this plugin

1. 2026-10-14 Version 2.10 New: Messente is now in the free plugin. You no longer need WSMS Pro to send SMS through Messente. Sites that already use it through Pro keep their settings. New: SMSense gateway (smsense.com, global coverage by Global V 2.10
2. 2026-10-01 Version 2.9 New: Send SMS warns you about duplicate numbers in the selected groups. New: Pick or skip individual members of a group on the Send SMS page. Enhancement: Variables like %subscriber_name% are filled in for each recipient 2.9
3. 2026-09-05 Version 2.8 Fix: Premium gateways like Twilio save without being rejected. Fix: The United States stays selected as your default country code ( #535 ). Fix: The setup wizard makes the United States easy to find ( #522 ). Fix: The Me 2.8
4. 2026-08-08 Version 2.7 Fix: Translations work again on WordPress 6.7+. Fix: A number isn’t added to your subscriber list when its confirmation SMS fails ( #514 ). Fix: A half-finished update no longer takes the site down. Fix: Forminator notif 2.7
5. 2026-07-30 Version 2.6 New: Added the LogisticSMS gateway New: Added the wpsms_unsubscribe_success_message filter to customize the newsletter unsubscribe confirmation message, with the unsubscribed group passed to the filter for both the unsub 2.6
6. 2026-05-19 Version 2.5 Fix: Fixed missing field placeholder chips in the Quform integration message body. Fix: Fixed [wp_sms_subscriber_form] shortcode showing an empty group list when “Available groups” is blank; it now falls back to all grou 2.5

All 17 disclosed vulnerabilities are patched in the current version (7.2.10). Sites still on an older version should update.

1. Patched Medium · 4.3 WSMS (formerly WP SMS) – SMS & MMS Notifications with OTP and 2FA for WooCommerce <= 7.2.1 - Authenticated (Subscriber+) Information Exposure ↗
   2026-04-23 CVE-2026-40790 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 7.2.1 Patched in 7.2.2
2. Patched Medium · 4.4 WSMS (formerly WP SMS) – SMS & MMS Notifications with OTP and 2FA for WooCommerce <= 7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
   2026-02-10 CVE-2026-25343 Improper Neutralization of Input During Web Page Generation Affects <= 7.1 Patched in 7.1.1
3. Patched Medium · 4.3 WP SMS <= 7.0.1 - Missing Authorization ↗
   2025-10-16 CVE-2025-62006 Missing Authorization Affects <= 7.0.1 Patched in 7.0.2
4. Patched Medium · 4.9 SMS <= 6.9.12 - Authenticated (Administrator+) SQL Injection ↗
   2025-06-14 CVE-2026-28136 Improper Neutralization of Special Elements used in an SQL Command Affects <= 6.9.12 Patched in 7.0
5. Patched Medium · 5.3 WP SMS <= 6.9.3 - Missing Authorization ↗
   2024-08-16 CVE-2024-43331 Missing Authorization Affects <= 6.9.3 Patched in 6.9.4
6. Patched Medium · 4.4 WP SMS <= 6.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
   2024-05-13 CVE-2024-34811 Improper Neutralization of Input During Web Page Generation Affects <= 6.5.1 Patched in 6.5.2
7. Patched Medium · 4.3 WP SMS <= 6.6.2 - Cross-Site Request Forgery ↗
   2024-03-28 CVE-2024-30454 Cross-Site Request Forgery Affects <= 6.6.2 Patched in 6.6.3
8. Patched Medium · 6.4 WP SMS <= 6.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗
   2024-02-14 CVE-2024-25920 Improper Neutralization of Input During Web Page Generation Affects <= 6.3.4 Patched in 6.4
9. Patched Medium · 6.1 WP SMS <= 6.5.2 - Reflected Cross-Site Scripting via 'page' ↗
   2024-02-05 CVE-2024-24881 Improper Neutralization of Input During Web Page Generation Affects <= 6.5.2 Patched in 6.5.3
10. Patched Medium · 6.4 WP SMS <= 6.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2024-01-12 Improper Neutralization of Input During Web Page Generation Affects <= 6.5.1 Patched in 6.5.2
11. Patched Medium · 4.3 WP SMS <= 6.5 - Cross-Site Request Forgery to Subscriber Deletion ↗
    2024-01-02 CVE-2023-6980 Cross-Site Request Forgery Affects <= 6.5 Patched in 6.5.1
12. Patched Medium · 6.1 WP SMS <= 6.5 - Authenticated (Admin+) SQL Injection to Reflected Cross-Site Scripting ↗
    2024-01-02 CVE-2023-6981 Improper Neutralization of Special Elements used in an SQL Command Affects <= 6.5 Patched in 6.5.1
13. Patched Medium · 4.3 WP SMS <= 6.1.5 - Cross-Site Request Forgery ↗
    2023-07-07 Cross-Site Request Forgery Affects < 6.2.0 Patched in 6.2.0
14. Patched Medium · 6.1 WP SMS <= 6.1.4 - Reflected Cross-Site Scripting via 'delete_mobile' ↗
    2023-05-15 CVE-2023-32742 Improper Neutralization of Input During Web Page Generation Affects <= 6.1.4 Patched in 6.1.5
15. Patched Medium · 5.3 WP SMS <= 6.0.4 - Information Disclosure via REST API ↗
    2023-03-02 CVE-2023-27447 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 6.0.4 Patched in 6.0.4.1
16. Patched Medium · 5.5 WP SMS <= 5.4.12 - Authenticated Stored Cross-Site Scripting ↗
    2021-07-26 CVE-2021-24561 Improper Neutralization of Input During Web Page Generation Affects < 5.4.13 Patched in 5.4.13
17. Patched Medium · 6.1 WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc <= 5.4.9 - Reflected Cross-Site Scripting ↗
    2021-06-30 Improper Neutralization of Input During Web Page Generation Affects <= 5.4.9 Patched in 5.4.9.1

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

Translated into 81 languages, 0 at 90% or more

Plus 57 more locales with partial translations.

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Not measured yet for this plugin’s topics. Its tracked searches are not among the measured topics. See the topics measured so far.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-04-28 8K+ → 7K+ down after 37 days in tier
2. 2026-03-22 9K+ → 8K+ down after 164 days in tier
3. 2025-10-09 10K+ → 9K+ down after 4 days in tier
4. 2025-10-05 9K+ → 10K+ up after 3 days in tier
5. 2025-10-02 10K+ → 9K+ down after 2 days in tier
6. 2025-09-30 9K+ → 10K+ up after 5 days in tier
7. 2025-09-25 10K+ → 9K+ down after 1 days in tier
8. 2025-09-24 9K+ → 10K+ up after 1 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for WSMS (formerly WP SMS): SMS and OTP for WordPress and WooCommerce into a readme, a review or a deck. It updates itself.

WSMS (formerly WP SMS): SMS and OTP for WordPress and WooCommerce: 7K+ active installs, 4.1★ (107 reviews). Plugin Pulse (WP Mayor), as of 2026-10-31. https://plugins.wpmayor.com/plugin/wp-sms