Skip to content
PluginCanary

PPOM

PPOM - Product Addons & Custom Fields for WooCommerce
by Themeisle · 20,000+ active installs · Checked 4 Nov 2026
Healthy

Healthy: maintained, last release 22 Oct 2026, 24 releases in 24 months, no unpatched vulnerabilities.

86/ 100 Canary Score
Sub-scores for PPOM
Ownership100
Maintenance100
Security60
SupportNo data
Reputation85

How the score works

Quick answers

Is PPOM still maintained?
Yes. Last release 22 Oct 2026, 24 releases in the last 24 months. 22 Oct 2026 · wordpress.org
Who owns PPOM, and has it changed hands?
No change recorded. Main committer themeisle since Aug 2022. 4 Nov 2026 · SVN log
Was PPOM removed from wordpress.org?
No. Listed on wordpress.org as of 4 Nov 2026. 4 Nov 2026 · wordpress.org
Is PPOM safe?
14 known vulnerabilities, all fixed (latest in 34.0.11). Not on the exploited list. 9 Oct 2026 · Wordfence Intelligence
Is the latest PPOM update safe to install?
No ownership change before 34.0.12. No one-star spike after it. 22 Oct 2026 · Release history

Active signals

Facts we detected, with links to the source.

No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
nmedia24 Apr 2015 to 5 Aug 2022, 335 commits
themeisle12 Aug 2022 to 22 Oct 2026, 91 commits

2 committers recorded. No ownership change since 2015.

Maintenance

Last release
14 days ago
Releases, 24 months
24
Tested up to
7.1 current
Requires PHP
7.2 supported 8.2+
Releases per quarter
Releases per quarter for PPOM
Q1 20246
Q2 20247
Q3 20247
Q4 20247
Q1 20252
Q2 20252
Q3 20253
Q4 20253
Q1 20260
Q2 20265
Q3 20266
Q4 20262

Last release 22 Oct 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: 5.0 (2 reviews). Lifetime: 4.5.

Average rating per quarter for PPOM
Q1 20244.0
Q2 20244.5
Q3 20245.0
Q4 20245.0
Q1 20254.0
Q2 20255.0
Q3 20255.0
Q4 20253.0
Q2 20263.7
Q3 20265.0
Q4 20265.0

Average rating rose from 4.0 to 5.0 between Q1 2024 and Q4 2026.

Rating distribution
5 star235
4 star5
3 star9
2 star6
1 star28
Latest low reviews

Security record

6 vulnerabilities in 24 months (14 on record), all patched (latest fixed in 34.0.11).

Show 14 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
9 Oct 2026PPOM <= 34.0.10 - Unauthenticated Arbitrary File Deletion via 'ppom[fields][<data_name>][n][org]' Parameter9.1<= 34.0.1034.0.11Patched before disclosure
25 Jun 2026PPOM - Product Addons & Custom Fields for WooCommerce <= 33.0.18 - Missing Authorization5.3<= 33.0.1834.0.0Patched before disclosure
17 Nov 2025PPOM for WooCommerce <= 33.0.16 - Missing Authorization4.3<= 33.0.1633.0.17Patched before disclosure
17 Oct 2025PPOM - Product Addons & Custom Fields for WooCommerce <= 33.0.15 - Unauthenticated SQL Injection7.5<= 33.0.1533.0.16Patched before disclosure
17 Oct 2025PPOM - Product Addons & Custom Fields for WooCommerce <= 33.0.15 - Unauthenticated Arbitrary File Upload9.8<= 33.0.1533.0.16Patched before disclosure
24 Jan 2025PPOM for WooCommerce <= 33.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting4.4<= 33.0.833.0.9Patched before disclosure
6 Jun 2024PPOM for WooCommerce <= 32.0.20 - Unauthenticated Content Injection Vulnerability5.3<= 32.0.2032.0.21Patched before disclosure
25 Apr 2024Product Addons & Fields for WooCommerce <= 32.0.18 - Unauthenticated Arbitrary File Upload via ppom_upload_file9.8<= 32.0.1832.0.19Patched before disclosure
1 Feb 2024ThemeIsle SDK <= Various Versions - Missing Authorization5.3<= 32.0.932.0.1028
2 May 2023PPOM for WooCommerce <= 32.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings4.4< 32.0.632.0.6Patched before disclosure
1 May 2023PPOM for WooCommerce <= 32.0.6 - Reflected Cross-Site Scripting6.1<= 32.0.632.0.73
17 Jan 2022PPOM for WooCommerce <= 23.9 - Missing Authorization to Stored Cross-Site Scripting5.4<= 23.924.0Patched before disclosure
10 Aug 2019PPOM for WooCommerce <= 18.3 - Authenticated Stored Cross-Site Scripting5.4< 18.418.4Patched before disclosure
19 Sep 2016PPOM for WooCommerce <= 1.1 - Arbitrary File Upload9.8<= 1.12.0Patched before disclosure

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

50% of 2 support threads resolved in the last 2 months.

Momentum

20,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for PPOM
4 May 2026239
11 May 20268,358
18 May 202610,724
25 May 20262,486
1 Jun 20269,361
8 Jun 20262,209
15 Jun 20261,709
22 Jun 202614,950
29 Jun 20262,951
6 Jul 20268,946
13 Jul 202610,833
20 Jul 20269,555
27 Jul 20268,492
3 Aug 20264,194
10 Aug 20261,742
17 Aug 20261,492
24 Aug 20261,285
31 Aug 20261,267
7 Sep 20269,276
14 Sep 20262,925
21 Sep 20261,993
28 Sep 20268,845
5 Oct 202611,627
12 Oct 20263,019
19 Oct 20269,310
26 Oct 20264,151
2 Nov 2026383

Weekly downloads over the last 4 weeks are 25% below the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

Extra Product Options For WooCommerceScore 96 · 30,000+YITH WooCommerce Product Add-OnsScore 96 · 20,000+Flexible Product Fields (WooCommerceScore 96 · 10,000+Product Addons for WoocommerceScore 93 · 30,000+Advanced Product Fields (Product Addons)Score 87 · 50,000+

Facts

Version34.0.12
AuthorThemeisle
Added24 Apr 2015
Last updated22 Oct 2026
Active installs20,000+
Requires WordPress6.2
Tested up to7.1.4
Requires PHP7.2
CategoryE-commerce & Shopping
Tagscustom fields, Product Addons, Variable Products, Woocommerce Product Addons, woocommerce product options

Other plugins by this author: LightStart - Maintenance Mode, Coming Soon and Landing Page Builder, Otter Blocks - Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE, Redirection for Contact Form 7, Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More, Robin Image Optimizer - Unlimited Image Optimization, WebP & AVIF, Starter Sites & Templates by Neve, Disable Admin Notices - Hide Dashboard Notifications, Menu Icons by Themeisle - Add Icons to Navigation Menus, Woody Code Snippets - Insert PHP, CSS, JS, and Header/Footer Scripts, Titan Anti-spam & Security - Brute Force Protection, 2FA & Spam Filter, RSS Aggregator by Feedzy - Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator, Remove Category URL - Remove ‘category’ base from category permalinks

Questions

Is PPOM still maintained?

Yes. Last release 22 Oct 2026, 24 releases in the last 24 months.

Who owns PPOM, and has it changed hands?

No change recorded. Main committer themeisle since Aug 2022.

Was PPOM removed from wordpress.org?

No. Listed on wordpress.org as of 4 Nov 2026.

Is PPOM safe?

14 known vulnerabilities, all fixed (latest in 34.0.11). Not on the exploited list.

Is the latest PPOM update safe to install?

No ownership change before 34.0.12. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 4 Nov 2026.Report a data issue