tadrik Free store check

Plugin security

WooCommerce plugin vulnerabilities: is your store affected?

Security holes in plugins that WooCommerce stores run, each rated 7 or higher out of 10, usable with no login or a customer account, and each with a fixed version out. Find your plugin, compare its version, update.

A plugin is listed here when our store checks found it in a vulnerable version on at least 5 WooCommerce stores, or when a new serious hole is published in a plugin many of the stores we look at load.

PluginHolesSafe fromNewestStores found
WooCommerce411.1.04 September 2026457
Essential Addons for Elementor96.8.828 October 202681
Elementor64.3.229 June 202665
GTM4WP (Google Tag Manager for WordPress)11.22.428 July 202632
HUSKY Products Filter for WooCommerce131.4.730 October 202631
LiteSpeed Cache107.9.127 August 202628
Click to Chat24.455 June 202627
FiboSearch (Ajax Search for WooCommerce)21.34.29 October 202627
WPForms Lite21.10.0.528 May 202625
Customer Reviews for WooCommerce75.123.024 September 202621
ElementsKit Elementor Addons33.7.923 February 202620
Contact Form 725.3.217 December 202019
CleanTalk Anti-Spam86.909 October 202618
Popup Maker41.25.017 September 202618
Smush24.3.027 August 202618
Jetpack112.1.130 May 202316
WooCommerce PayPal Payments14.0.222 May 202615
Jeg Kit for Elementor23.2.1731 July 202611
Redux Framework14.4.1822 July 202411
Advanced AJAX Product Filters13.2.14 August 202610
Fluent Forms106.2.1231 July 202610
TablePress33.3.225 June 202610
Ultimate Member172.14.028 October 202610
User Profile Builder154.0.630 October 202610
W3 Total Cache162.11.030 October 202610
MonsterInsights110.1.312 May 20269
Newsletter39.4.130 September 20269
PixelYourSite211.2.0.220 February 20269
WooCommerce Square25.1.29 January 20268
WPML Multilingual & Multicurrency for WooCommerce15.5.89 April 20258
YITH Request a Quote for WooCommerce14.46.03 September 20268
Advanced Product Fields Extended for WooCommerce13.1.710 September 20267
GeneratePress Premium12.5.618 August 20267
ProfilePress84.17.52 October 20267
Royal Addons for Elementor171.7.106914 September 20267
The Events Calendar116.17.4.130 September 20267
TI WooCommerce Wishlist72.10.016 May 20257
Advanced Product Fields (Product Addons) for WooCommerce11.6.2220 April 20266
Kadence Blocks23.7.124 October 20266
Starter Templates34.4.425 December 20256

Stores found counts the stores, in our check of 3,600 live UK and US WooCommerce stores, that ran a vulnerable version of that plugin with a fix already out. We never name them. How we checked.

Safe from is the version that fixes every hole on that plugin's page.

Not sure, or no time?

Get a free check of your store: we look at its public pages for plugins with known holes, and reply within one working day. Or we fix it for you: we update your store on a copy, place a test order, and only then change the live store, for a fixed £99 / $119.

Free store check Fix it for me on a copy

Vulnerability data: WPVulnerability (wpvulnerability.net, CC0), which links each entry to its CVE or advisory. Store numbers: Tadrik's own checks of public pages, aggregates only. Page updated 3 November 2026.