1 in 4 WooCommerce stores runs a plugin with a serious, already-fixed security hole

What we found

• Most of it is plugins, not WooCommerce. 651 of the 858 stores have a serious finding in a plugin other than WooCommerce; for 207 the only one is in WooCommerce itself.
• It rarely comes alone. 343 stores (10% of all checked) have more than one plugin with a serious, fixed vulnerability.
• WooCommerce updates lag. 457 stores (14% of those with a readable version) run a WooCommerce older than 11.1.0, which fixed CVE-2026-48888 (a denial-of-service issue, CVSS 7.5, no login needed). 33 still run WooCommerce 3 or older, which stopped getting updates in early 2020.
• Customer accounts are a door. Besides the no-login issues, we counted 482 serious findings that need only a customer account, which any shopper can create on most stores.

The plugins most often behind

Stores with at least one serious, fixed vulnerability in that plugin. Each of these has an update that closes it.

Plugin	Stores
WooCommerce	457
Essential Addons for Elementor	81
Elementor	65
GTM4WP (Google Tag Manager for WordPress)	32
HUSKY Products Filter (woocommerce-products-filter)	31
LiteSpeed Cache	28
Click to Chat for WhatsApp	27
FiboSearch (ajax-search-for-woocommerce)	27
WPForms Lite	25
Customer Reviews for WooCommerce	21
ElementsKit Lite	20
Contact Form 7	19

None of this says these plugins are badly made. Popular plugins get more security research, and every one of them shipped a fix. The gap is between the fix and the store.

How we checked

• Stores: 6,000 UK and US domains that showed WooCommerce in the Common Crawl index (85% of the WooCommerce ones on .uk domains). 3,600 answered and ran WooCommerce; 1,178 sat behind a bot challenge, 870 didn't answer and 352 no longer ran WooCommerce. Those 2,400 are left out.
• Passive only: one request for the home page, one for /checkout/, and the public readme.txt of a plugin we had a reason to check. No logins, no forms, no attempts to exploit anything.
• A finding counts only when the installed version is confirmed by two sources (the version on the page's assets and the plugin's readme), the vulnerability is rated 7.0 or higher (CVSS), it needs no login or only a customer login, and a fixed version exists.
• Vulnerability data: WPVulnerability (CC0), which links each entry to its CVE and source.
• Limits: stores that hide versions or block scripts are not counted, so the real share may be higher. A store can patch by hand without changing the version number; that is rare, but it would make our count too high for that store.

We don't publish which stores are affected. We are writing privately to store owners, with the source of each finding and how to fix it for free.

What a store owner can do today

1. In WordPress, go to Dashboard > Updates and update the plugins that show a new version, on a staging copy first if you can.
2. Delete plugins you no longer use. A deactivated plugin's files can still be reached.
3. Turn on automatic updates for small plugins you don't customise.
4. After each update, place a test order to make sure checkout still works.

You can quote these numbers with a link to this page.