Skip to content
PluginCanary

WooCommerce

by Automattic · 7,000,000+ active installs · Checked 3 Nov 2026
Healthy3 Warnings

Healthy: vulnerability published 8 Oct 2026, fixed in 11.2.0.

85/ 100 Canary Score
Sub-scores for WooCommerce
Ownership100
Maintenance100
Security60
Support79
Reputation85

How the score works

Active signals

Facts we detected, with links to the source.

  • WarningSEC-1Vulnerability published 8 Oct 2026, fixed in 11.2.0. Update to version 11.2.0 or later.8 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 7 Sep 2026, fixed in 11.1.0. Update to version 11.1.0 or later.7 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 4 Sep 2026, fixed in 11.0. Update to version 11.0 or later.4 Sep 2026Evidence
  • InfoSEC-38 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
mikejolley10 Feb 2014 to 16 Apr 2019, 82 commits
claudiosanches10 Sep 2014 to 27 Apr 2022, 174 commits
claudiulodro28 Apr 2017 to 21 Jan 2019, 9 commits
Kloon31 Jan 2018 to 21 Aug 2020, 8 commits
rodrigosprimo10 Apr 2018 to 21 Oct 2020, 14 commits
peterfabian100023 May 2018 to 3 May 2023, 30 commits
timmydcrawford15 Mar 2019 to 25 Apr 2019, 13 commits
vedjain3 Oct 2019 to 23 Jul 2021, 23 commits
obliviousharmony19 Dec 2019 to 10 Jun 2024, 30 commits
konamiman30 Jun 2020 to 5 Feb 2025, 21 commits
sadowski20 Aug 2020 to 1 Dec 2023, 83 commits
royho19 Jan 2021 to 27 Dec 2022, 32 commits
barry.hughes3 Aug 2021 to 4 Dec 2024, 26 commits
psealock19 Jul 2022 to 6 Jul 2023, 19 commits
samueljseay23 Nov 2022 to 14 Mar 2023, 11 commits
leifsinger21 Mar 2023 to 26 Apr 2023, 7 commits
lanej03 Oct 2023 to 6 Oct 2023, 2 commits
alopezari10 Oct 2023 to 30 Jan 2024, 12 commits
nigeljamesstevenson16 Oct 2023 to 29 Jul 2024, 32 commits
rodelgc16 Nov 2023 to 15 Jul 2024, 23 commits
ivanstojadinov27 Feb 2024 to 18 Jun 2024, 15 commits
athomo29 Apr 2024 to 14 May 2024, 7 commits
jamosova18 Jun 2024 to 12 Jul 2024, 10 commits
jorgeatorres6 Aug 2024 to 8 Jun 2026, 47 commits
namanorg26 Aug 2024 to 25 Sep 2024, 6 commits
coreymckrill2 Oct 2024 to 3 Dec 2024, 12 commits
albarin21 Jan 2025 to 25 Feb 2025, 4 commits
prettyboymp26 May 2025 to 23 Jun 2025, 10 commits
WooCommerce8 Aug 2025 to 2 Nov 2026, 144 commits
automattic1 Sep 2025 to 1 Sep 2025, 2 commits
senadir22 Dec 2025 to 2 Mar 2026, 76 commits
kraftbj10 Aug 2026 to 10 Aug 2026, 2 commits

New committer kraftbj made a first commit on 10 Aug 2026.

Maintenance

Last release
25 days ago
Releases, 24 months
204
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter for WooCommerce
Q1 202413
Q2 202430
Q3 202419
Q4 202416
Q1 202511
Q2 202517
Q3 202518
Q4 202541
Q1 202667
Q2 202613
Q3 202619
Q4 20265

Last release 9 Oct 2026. Tested with WordPress 7.1 (current).

Support

79% of 126 support threads resolved in the last 2 months.

Security record

PublishedIssueCVSSAffectedFixed inDays to patch
8 Oct 2026WooCommerce 9.8.0 - 11.1.2 - Authenticated (Shop Manager+) Privilege Escalation4.79.8.0 to 11.1.211.2.00
7 Sep 2026WooCommerce < 11.1.0 - Unauthenticated Denial of Service7.5< 11.1.011.1.00
4 Sep 2026WooCommerce <= 10.9.4 - Authenticated (Shop Manager+) SQL Injection4.9<= 10.9.411.0n/a
10 Mar 2026WooCommerce < 10.5.3 - Cross-Site Request Forgery4.3< 10.5.310.5.30
22 Dec 2025WooCommerce <= 10.4.2 - Authenticated (Subscriber+) Information Exposure4.310.0 to 10.0.4, 10.1 to 10.1.2, 10.2 to 10.2.2, 10.3 to 10.3.6, 8.1 to 8.1.2, 8.2 to 8.2.3, 8.3 to 8.3.2, 8.4 to 8.4.1, 8.5 to 8.5.3, 8.6 to 8.6.2, 8.7 to 8.7.1, 8.8 to 8.8.5, 8.9 to 8.9.3, 9.0 to 9.0.2, 9.1 to 9.1.4, 9.2 to 9.2.3, 9.3 to 9.3.4, 9.4 to 9.4.3, 9.5 to 9.5.2, 9.6 to 9.6.2, 9.7 to 9.7.1, 9.8 to 9.8.5, 9.9 to 9.9.58.1.31
29 Oct 2025WooCommerce <= 10.0.2 - Authenticated (Shop manager+) Stored Cross-Site Scripting4.4<= 10.0.210.0.30
21 May 2025WooCommerce <= 9.4.2 - PostMessage-Based Cross-Site Scripting6.1<= 9.3.2, 9.4 to 9.4.29.3.40
12 Mar 2025WooCommerce <= 9.7.0 - Authenticated (Shop Manager+) Stored Cross-Site Scripting4.4<= 9.7.09.7.10
14 Oct 2024WooCommerce <= 9.0.2 - Unauthenticated HTML Injection5.3<= 9.0.29.1.00
16 Aug 2024WooCommerce <= 9.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting4.4<= 9.1.29.1.30
27 Jun 2024WooCommerce <= 8.9.2 - Authenticated (Shop Manager+) Content Injection2.7<= 8.9.29.0.00
10 Jun 2024WooCommerce 8.8.0 - 8.9.2 - Reflected Cross-Site Scripting via Order Attribution6.18.8.0 to 8.8.4, 8.9.0 to 8.9.28.8.50
5 Apr 2024WooCommerce <= 8.5.2 - Cross-Site Request Forgery4.3<= 8.5.28.6.00
12 Jan 2024WooCommerce < 8.4.0 - Reflected Cross-Site Scripting6.1< 8.4.08.4.00
5 Jan 2024WooCommerce <= 8.2.2 - Cross-Site Request Forgery4.3<= 8.2.28.3.00
15 Nov 2023WooCommerce <= 8.1.1 & WooCommerce Blocks <= 11.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Featured Image alt Attribute6.4<= 8.1.18.2.00
11 Sep 2023WooCommerce <= 7.0.0 - Authenticated(Shop Manager+) Sensitive Information Exposure4.9<= 7.0.07.0.10
11 Sep 2023WooCommerce <= 7.8.2 - Sensitive Information Exposure5.3<= 7.8.27.9.00
20 Jun 2022WooCommerce <= 6.5.1 - Authenticated (Admin+) HTML Injection5.5< 6.6.06.6.00
10 Apr 2022WooCommerce < 5.7.0 & WooCommerce Admin < 2.6.4 - Information Disclosure6.5< 4.0, 4.0 to 4.0.3, 4.1 to 4.1.3, 4.2 to 4.2.4, 4.3 to 4.3.5, 4.4 to 4.4.3, 4.5 to 4.5.4, 4.6 to 4.6.4, 4.7 to 4.7.3, 4.8 to 4.8.2, 4.9 to 4.9.4, 5.0 to 5.0.2, 5.1 to 5.1.2, 5.2 to 5.2.4, 5.3 to 5.3.2, 5.4 to 5.4.3, 5.5 to 5.5.3, 5.6 to 5.6.14.0.30
10 Mar 2022WooCommerce < 6.3.1 - Unauthorized Order Status Change4.33.5 to 3.5.10, 3.6 to 3.6.7, 3.7 to 3.7.3, 3.8 to 3.8.3, 3.9 to 3.9.5, 4.0 to 4.0.4, 4.1 to 4.1.4, 4.2 to 4.2.5, 4.3 to 4.3.6, 4.4 to 4.4.4, 4.5 to 4.5.5, 4.6 to 4.6.5, 4.7 to 4.7.4, 4.8 to 4.8.3, 4.9 to 4.9.5, 5.0 to 5.0.3, 5.1 to 5.1.3, 5.2 to 5.2.5, 5.3 to 5.3.3, 5.4 to 5.4.4, 5.5 to 5.5.4, 5.6 to 5.6.2, 5.7 to 5.7.2, 5.8 to 5.8.1, 5.9 to 5.9.1, 6.0 to 6.0.1, 6.1 to 6.1.2, 6.2 to 6.2.2, 6.3 to 6.3.13.5.101
22 Feb 2022WooCommerce <= 6.2.0 - Incorrect Authorization Checks on REST API Endpoints5.4<= 6.2.06.2.11
22 Feb 2022WooCommerce <= 6.2.0 - Path Traversal via Tax Importer7.2<= 6.2.06.2.11
13 Jul 2021WooCommerce < 5.5 - Authenticated Blind SQL Injection8.8< 3.3, 3.3 to 3.3.5, 3.4 to 3.4.7, 3.5 to 3.5.8, 3.6 to 3.6.5, 3.7 to 3.7.1, 3.8 to 3.8.1, 3.9 to 3.9.3, 4.0 to 4.0.1, 4.1 to 4.1.1, 4.2 to 4.2.2, 4.3 to 4.3.3, 4.4 to 4.4.1, 4.5 to 4.5.2, 4.6 to 4.6.2, 4.7 to 4.7.1, 4.8, 4.9 to 4.9.2, 5.0, 5.1, 5.2 to 5.2.2, 5.3, 5.4 to 5.4.1, 5.53.3.62
21 Apr 2021WooCommerce <= 5.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting4.8< 5.2.05.2.00

Source: Wordfence Intelligence.

Reputation

Average rating rose from 4.4 to 5.0 between Q3 2026 and Q4 2026.

Rating distribution
5 star4005
4 star197
3 star113
2 star108
1 star410
Latest low reviews

Momentum

7,000,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for WooCommerce
4 May 2026169,162
11 May 2026338,996
18 May 2026555,479
25 May 20262,817,983
1 Jun 2026514,717
8 Jun 2026388,926
15 Jun 2026344,958
22 Jun 20261,608,239
29 Jun 20261,684,447
6 Jul 20262,123,961
13 Jul 2026490,626
20 Jul 2026407,319
27 Jul 2026354,588
3 Aug 20262,030,882
10 Aug 20262,063,333
17 Aug 2026454,384
24 Aug 2026395,618
31 Aug 20261,685,922
7 Sep 2026568,489
14 Sep 20261,846,719
21 Sep 20262,252,094
28 Sep 2026523,970
5 Oct 20262,933,941
12 Oct 2026689,067
19 Oct 2026587,992
26 Oct 2026750,150
2 Nov 202676,716

Weekly downloads over the last 4 weeks are 50% below the 27-week average.

Healthier alternatives

Same category, higher Canary Score. Never sponsored.

Commerce7 for WordPressScore 91 · 1,000+External Store for ShopifyScore 87 · 2,000+Product Catalog SimpleScore 86 · 1,000+

Facts

Version11.2.1
AuthorAutomattic
Added27 Sep 2011
Last updated9 Oct 2026
Active installs7,000,000+
Requires WordPress7.0
Tested up to7.1.4
Requires PHP7.4
CategoryE-commerce & Shopping
Tagsshop, ecommerce, sell online, online store, shopping cart

Other plugins by this author: Akismet Anti-spam: Spam Protection, Jetpack - AI Agents & MCP, Security, Backup & Analytics, WP Super Cache, WooCommerce Legacy REST API, Limit Login Attempts, Crowdsignal Forms, Crowdsignal Dashboard - Polls, Surveys & more, Jetpack Boost - Website Speed, Performance and Critical CSS, Layout Grid Block, Page Optimize, Jetpack Protect, Gravatar Enhanced - Avatars, Profiles, and Privacy

Questions

Is WooCommerce still maintained?

WooCommerce was last updated on 9 Oct 2026. Its Canary status is Healthy.

Is WooCommerce safe?

WooCommerce has no open unpatched vulnerabilities on record. 8 vulnerabilities were published in the last 24 months. Its Canary status is Healthy.

Who owns WooCommerce?

The wordpress.org author is Automattic. Recent committers: WooCommerce, kraftbj, jorgeatorres, senadir, automattic. New committer kraftbj made a first commit on 10 Aug 2026.

What can I use instead of WooCommerce?

Plugins in the same category with a higher Canary Score: Commerce7 for WordPress, External Store for Shopify, Product Catalog Simple.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews, Wordfence Intelligence.Plugin data refreshed 3 Nov 2026.Report a data issue