Skip to content
PluginCanary

WC Vendors

WC Vendors - WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors
by WCVendors · 3,000+ active installs · Checked 3 Nov 2026
Healthy

Healthy: maintained, last release 19 Oct 2026, 25 releases in 24 months, no unpatched vulnerabilities.

81/ 100 Canary Score
Sub-scores for WC Vendors
Ownership100
Maintenance100
Security60
Support70
Reputation70

How the score works

Quick answers

Is WC Vendors still maintained?
Yes. Last release 19 Oct 2026, 25 releases in the last 24 months. 19 Oct 2026 · wordpress.org
Who owns WC Vendors, and has it changed hands?
No change recorded. Main committer paulgrymera since Apr 2024. 3 Nov 2026 · SVN log
Was WC Vendors removed from wordpress.org?
No. Listed on wordpress.org as of 3 Nov 2026. 3 Nov 2026 · wordpress.org
Is WC Vendors safe?
10 known vulnerabilities, all fixed (latest in 2.7.2.2). Not on the exploited list. 17 Sep 2026 · Wordfence Intelligence
Is the latest WC Vendors update safe to install?
No ownership change before 2.7.3. No one-star spike after it. 19 Oct 2026 · Release history

Active signals

Facts we detected, with links to the source.

No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
plugin-master28 Aug 2014 to 23 May 2023, 3 commits
digitalchild15 Oct 2014 to 31 Mar 2023, 316 commits
jkohlbach23 May 2023 to 11 Jul 2024, 24 commits
paulgrymera11 Apr 2024 to 19 Oct 2026, 50 commits

4 committers recorded. No ownership change since 2014.

Maintenance

Last release
16 days ago
Releases, 24 months
25
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter
Releases per quarter for WC Vendors
Q1 20247
Q2 20244
Q3 20241
Q4 20241
Q1 20252
Q2 20255
Q3 20253
Q4 20255
Q1 20262
Q2 20263
Q3 20264
Q4 20261

Last release 19 Oct 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: no reviews. Lifetime: 4.5.

Rating distribution
5 star158
4 star8
3 star3
2 star1
1 star18

Security record

8 vulnerabilities in 24 months (10 on record), all patched (latest fixed in 2.7.2.2).

Show 10 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
17 Sep 2026WC Vendors - WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors <= 2.7.2.1 - Authenticated (Administrator+) SQL Injection4.9<= 2.7.2.12.7.2.2Patched before disclosure
2 Sep 2026WC Vendors - WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors < 2.7.2.1 - Authenticated (Custom Role+) Insecure Direct Object Reference4.3< 2.7.2.12.7.2.1Patched before disclosure
2 Sep 2026WC Vendors - WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors < 2.7.2.1 - Cross-Site Request Forgery4.3< 2.7.2.12.7.2.1Patched before disclosure
2 Sep 2026WC Vendors - WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors < 2.7.2.1 - Authenticated (Custom Role+) Insecure Direct Object Reference4.3< 2.7.2.12.7.2.1Patched before disclosure
15 Aug 2026WC Vendors <= 2.7.0 - Authenticated (Shop Manager+) SQL Injection via 'status' Parameter4.9<= 2.7.02.7.1Patched before disclosure
18 Jun 2026WC Vendors - WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors <= 2.6.8 - Authenticated (Subscriber+) SQL Injection6.5<= 2.6.82.6.9Patched before disclosure
4 Dec 2025WC Vendors - WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors <= 2.6.4 - Cross-Site Request Forgery to Vendor Product Deletion4.3<= 2.6.42.6.4.1Patched before disclosure
5 Jun 2025WC Vendors Marketplace <= 2.5.6 - Authenticated (Administrator+) SQL Injection4.9<= 2.5.62.5.7Patched before disclosure
23 Nov 2023WC Vendors Marketplace <= 2.4.7 - Authenticated (Shop manager+) SQL Injection via search dates7.2<= 2.4.72.4.7.1Patched before disclosure
11 Jan 2023WC Vendors Marketplace <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Sites Scripting via Shortcode6.4<= 2.4.42.4.5132

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

100% of 1 support threads resolved in the last 2 months.

Momentum

3,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for WC Vendors
4 May 2026177
11 May 20261,913
18 May 2026770
25 May 2026454
1 Jun 2026451
8 Jun 2026343
15 Jun 20261,896
22 Jun 2026594
29 Jun 2026391
6 Jul 2026515
13 Jul 2026304
20 Jul 2026364
27 Jul 2026305
3 Aug 20262,064
10 Aug 2026512
17 Aug 2026697
24 Aug 20263,327
31 Aug 2026933
7 Sep 2026472
14 Sep 20262,314
21 Sep 2026674
28 Sep 2026576
5 Oct 2026430
12 Oct 2026407
19 Oct 20261,996
26 Oct 2026892
2 Nov 2026136

Weekly downloads over the last 4 weeks are 3% below the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

DokanScore 86 · 30,000+WCFM MembershipScore 84 · 10,000+WCFMScore 83 · 20,000+

Facts

Version2.7.3
AuthorWCVendors
Added15 Oct 2014
Last updated19 Oct 2026
Active installs3,000+
Requires WordPress6.2
Tested up to7.1.4
Requires PHP7.4
CategoryE-commerce & Shopping
TagsMarketplace, multivendor, multi vendor, product vendors, woocommerce commissions

Questions

Is WC Vendors still maintained?

Yes. Last release 19 Oct 2026, 25 releases in the last 24 months.

Who owns WC Vendors, and has it changed hands?

No change recorded. Main committer paulgrymera since Apr 2024.

Was WC Vendors removed from wordpress.org?

No. Listed on wordpress.org as of 3 Nov 2026.

Is WC Vendors safe?

10 known vulnerabilities, all fixed (latest in 2.7.2.2). Not on the exploited list.

Is the latest WC Vendors update safe to install?

No ownership change before 2.7.3. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 3 Nov 2026.Report a data issue