WooCommerce

97 Quality Score

Active Installs

30/30

With roughly 7 million active installs, WooCommerce is by a wide margin the most widely deployed ecommerce solution in the WordPress ecosystem, earning a perfect popularity score.

Update Freshness

25/25

It was updated on 2026-07-07, requires WordPress 6.9 and PHP 7.4, and is tested up to WordPress 7.0, which reflects an actively maintained codebase from a large team.

User Rating

14/15

An average rating of 90 out of 100 across 4,809 reviews indicates strong user satisfaction, though a small share of negative reviews is still expected given the install base.

Support Health

14/15

The official support threads sit at an 81.1% resolution rate, which is solid but lower than the maintenance and compatibility scores suggest, mostly because many free users post issues that belong to extensions or hosting.

WP Compatibility

15/15

Compatibility is essentially perfect, since it runs on current WordPress and PHP versions and is built to interoperate with thousands of third-party extensions and payment gateways.

Scores higher than 99% of indexed plugins

About

Everything you need to launch an online store in days and keep it growing for years. From your first sale to millions in revenue, Woo is with you.

Active Installs 7M+

Rating ★★★★½ 4.5/5

Last Updated 2026-09-22 2:40pm GMT

Requires WordPress 7.0+

Tested Up To 7.1.2

Requires PHP 7.4+

Security History

46 known vulnerabilities, all patched

11 High 34 Medium 1 Low

Most recent: September 7, 2026

View details ▸

WooCommerce < 11.1.0 - Unauthenticated Denial of Service High

September 7, 2026 Patched in ["11.1.0"] CVE-2026-48888

WooCommerce <= 10.9.4 - Authenticated (Shop Manager+) SQL Injection Medium

September 4, 2026 Patched in ["11.0"] CVE-2026-57777

WooCommerce < 10.5.3 - Cross-Site Request Forgery Medium

March 10, 2026 Patched in ["10.5.3"] CVE-2026-3589

WooCommerce <= 10.4.2 - Authenticated (Subscriber+) Information Exposure Medium

December 22, 2025 Patched in ["10.0.5","10.1.3","10.2.3","10.3.7","8.1.3","8.2.4","8.3.3","8.4.2","8.5.4","8.6.3","8.7.2","8.8.6","8.9.4","9.0.3","9.1.5","9.2.4","9.3.5","9.4.4","9.5.3","9.6.3","9.7.2","9.8.6","9.9.6"] CVE-2025-15033

WooCommerce <= 10.0.2 - Authenticated (Shop manager+) Stored Cross-Site Scripting Medium

October 29, 2025 Patched in ["10.0.3"] CVE-2025-49042

WooCommerce <= 9.4.2 - PostMessage-Based Cross-Site Scripting Medium

May 21, 2025 Patched in ["9.3.4","9.4.3"] CVE-2025-5062

WooCommerce <= 9.7.0 - Authenticated (Shop Manager+) Stored Cross-Site Scripting Medium

March 12, 2025 Patched in ["9.7.1"] CVE-2025-26762

WooCommerce <= 9.0.2 - Unauthenticated HTML Injection Medium

October 14, 2024 Patched in ["9.1.0"] CVE-2024-9944

WooCommerce <= 9.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting Medium

August 16, 2024 Patched in ["9.1.3"] CVE-2024-39666

WooCommerce <= 8.9.2 - Authenticated (Shop Manager+) Content Injection Low

June 27, 2024 Patched in ["9.0.0"] CVE-2024-35777

WooCommerce 8.8.0 - 8.9.2 - Reflected Cross-Site Scripting via Order Attribution Medium

June 10, 2024 Patched in ["8.8.5","8.9.3"] CVE-2024-37297

WooCommerce <= 8.5.2 - Cross-Site Request Forgery Medium

April 5, 2024 Patched in ["8.6.0"] CVE-2024-22155

WooCommerce < 8.4.0 - Reflected Cross-Site Scripting Medium

January 12, 2024 Patched in ["8.4.0"]

WooCommerce <= 8.2.2 - Cross-Site Request Forgery Medium

January 5, 2024 Patched in ["8.3.0"] CVE-2023-52222

WooCommerce <= 8.1.1 & WooCommerce Blocks <= 11.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Featured Image alt Attribute Medium

November 15, 2023 Patched in ["8.2.0"] CVE-2023-47777

WooCommerce <= 7.8.2 - Sensitive Information Exposure Medium

September 11, 2023 Patched in ["7.9.0"] CVE-2023-7320

WooCommerce <= 7.0.0 - Authenticated(Shop Manager+) Sensitive Information Exposure Medium

September 11, 2023 Patched in ["7.0.1"]

WooCommerce <= 6.5.1 - Authenticated (Admin+) HTML Injection Medium

June 20, 2022 Patched in ["6.6.0"] CVE-2022-2099

WooCommerce < 5.7.0 & WooCommerce Admin < 2.6.4 - Information Disclosure Medium

April 10, 2022 Patched in ["4.0.3","4.1.3","4.2.4","4.3.5","4.4.3","4.5.4","4.6.4","4.7.3","4.8.2","4.9.4","5.0.2","5.1.2","5.2.4","5.3.2","5.4.3","5.5.3","5.6.1","5.7.0"]

WooCommerce < 6.3.1 - Unauthorized Order Status Change Medium

March 10, 2022 Patched in ["3.5.10","3.6.7","3.7.3","3.8.3","3.9.5","4.0.4","4.1.4","4.2.5","4.3.6","4.4.4","4.5.5","4.6.5","4.7.4","4.8.3","4.9.5","5.0.3","5.1.3","5.2.5","5.3.3","5.4.4","5.5.4","5.6.2","5.7.2","5.8.1","5.9.1","6.0.1","6.1.2","6.2.2","6.3.1"]

WooCommerce <= 6.2.0 - Incorrect Authorization Checks on REST API Endpoints Medium

February 22, 2022 Patched in ["6.2.1"] CVE-2022-0775

WooCommerce <= 6.2.0 - Path Traversal via Tax Importer High

February 22, 2022 Patched in ["6.2.1"]

WooCommerce < 5.5 - Authenticated Blind SQL Injection High

July 13, 2021 Patched in ["3.3.6","3.4.8","3.5.9","3.6.6","3.7.2","3.8.2","3.9.4","4.0.2","4.1.2","4.2.3","4.3.4","4.4.2","4.5.3","4.6.3","4.7.2","4.8.1","4.9.3","5.0.1","5.1.1","5.2.3","5.3.1","5.4.2","5.5.1","5.5.2"] CVE-2021-32790

WooCommerce <= 5.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting Medium

April 21, 2021 Patched in ["5.2.0"] CVE-2021-24323

WooCommerce <= 4.6.1 & WooCommerce Blocks <= 3.7.0 - Settings Bypass leading to Account Creation Medium

November 5, 2020 Patched in ["4.6.2"]

WooCommerce <= 4.2.0 - Reflected Cross-Site Scripting Medium

June 22, 2020 Patched in ["4.2.1"]

WooCommerce <= 4.0.4 - Unauthorized Post Meta Creation/Modification High

May 5, 2020 Patched in ["4.1.0"]

WooCommerce < 4.7.0 - Insecure Direct Object Reference via order_id Parameter Medium

January 21, 2020 Patched in ["4.7.0"] CVE-2020-29156

WooCommerce <= 3.6.4 - Missing File Type Validation High

July 2, 2019 Patched in ["3.6.5"]

WooCommerce <= 3.6.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting High

July 2, 2019 Patched in ["3.6.5"]

WooCommerce <= 3.5.4 - Stored Cross-Site Scripting Medium

February 20, 2019 Patched in ["3.5.5"] CVE-2019-9168

WooCommerce <= 3.5.1 - Authenticated Stored Cross-Site Scripting Medium

November 29, 2018 Patched in ["3.5.2"]

WooCommerce <= 3.4.5 - WooCommerce File Deletion High

November 6, 2018 Patched in ["3.4.6"] CVE-2018-20714

WooCommerce <= 3.4.4 - Authenticated PHP Object Injection Medium

August 29, 2018 Patched in ["3.4.5"]

WooCommerce <= 3.2.3 - Authenticated PHP Object Injection High

November 16, 2017 Patched in ["3.2.4"] CVE-2017-18356

WooCommerce <= 2.6.8 - Authenticated Stored Cross-Site Scripting Medium

December 7, 2016 Patched in ["2.6.9"] CVE-2016-10112

WooCommerce <= 2.6.3 - Stored Cross-Site Scripting via REST-API Medium

July 26, 2016 Patched in ["2.6.4"]

WooCommerce <= 2.6.2 - Stored Cross-Site Scripting Medium

July 19, 2016 Patched in ["2.6.3"]

WooCommerce < 2.4.9 - Cross-site Scripting Medium

November 17, 2015 Patched in ["2.4.9"]

WooCommerce <= 2.3.10 - PHP Object Injection High

June 10, 2015 Patched in ["2.3.11"]

WooCommerce <= 2.3.5 - Stored Cross-Site Scripting High

March 13, 2015 Patched in ["2.3.6"] CVE-2015-2329

WooCommerce <= 2.2.10 - Cross-Site Scripting Medium

January 29, 2015 Patched in ["2.2.11"] CVE-2015-2069

WooCommerce <= 2.2.2 - Reflected Cross-Site Scripting Medium

September 17, 2014 Patched in ["2.2.3"]

WooCommerce <= 2.2.2 - Cross-Site Scripting via range Parameter High

September 15, 2014 Patched in ["2.2.3"] CVE-2014-6313

WooCommerce <= 2.0.17 - Cross-Site Scripting Medium

October 17, 2013 Patched in ["2.0.18"]

WooCommerce <= 2.0.12 - Self-Reflected Cross-Site Scripting Medium

July 18, 2013 Patched in ["2.0.13"]

What It Does

WooCommerce transforms any WordPress site into a full-featured online store, handling products, cart, checkout, payments, shipping, taxes, and order management out of the box. It ships with a REST API, webhooks, and an extensive extension ecosystem for everything from subscriptions to bookings. Because it is open source and self-hosted, you retain full ownership of your store data and customer relationships.

Who It's For

WooCommerce fits small to mid-sized merchants who already run on WordPress and want to avoid the monthly fees or revenue cuts charged by hosted SaaS carts. It works equally well for physical goods sellers, digital download vendors, and hybrid shops, provided they have at least basic comfort with plugins, themes, and hosting settings. Larger stores can scale it further, but only with the right infrastructure and developer support.

Who Should Skip It

Anyone who only needs a simple payment link or a few products should consider lighter alternatives such as SureCart or a hosted cart, since WooCommerce carries real overhead in setup, hosting, and ongoing maintenance. Non-technical users who cannot troubleshoot plugin conflicts or server issues will likely find it frustrating.

The Bottom Line

WooCommerce earns its 95.66 overall score with unmatched adoption, active maintenance, and strong compatibility, making it the default WordPress ecommerce plugin for most merchants. The trade-offs are real: support response quality varies because of the free tier's volume, and you are responsible for hosting, security, and backups. If you are willing to manage those, there is no comparable open-source store plugin at this scale.

Related Plugins

Download Monitor 90/100

Pick Download Monitor instead if your store is limited to selling digital downloads and you want a much lighter plugin with fewer moving parts than WooCommerce.

OptinMonster 87/100

OptinMonster is the better choice when your real goal is lead capture and email marketing rather than running a full storefront.

TI WooCommerce Wishlist 84/100

Use TI WooCommerce Wishlist as a complement rather than a replacement, adding wishlist functionality on top of an existing WooCommerce store.

SureCart 84/100

Choose SureCart if you want a modern, SaaS-style ecommerce experience for physical, digital, or subscription products with less hosting and configuration work than WooCommerce.

Menu Cart for WooCommerce 83/100

Menu Cart for WooCommerce is a small companion plugin that adds a cart icon to your navigation, not an alternative storefront.