WooCommerce

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

A large install base, a clear pro tier and a steady trend. As reliable as an outside estimate gets. The range spans more than 10x because wp.org publishes install counts as broad bands, and conversion and price compound on top. Read the midpoint as an order of magnitude, not a valuation.

Reviewers mostly praise WooCommerce's support team for fast, helpful replies, with one recent complaint about updates that don't fix existing bugs.

1. ★★★★★ louisenglish1990

   1mo ago

   Absolutley excellent feedback, I spoke with our admin team and there was a filter applied in the background that was not allowing me to search. Thank you for all of your help

   Read on wp.org ↗
2. ★★★★★ jimk1416

   2mo ago

   very quick and reliable support if you have any issues

   Read on wp.org ↗
3. ★★★★★ wopodk

   2mo ago

   Extremely helpful and fast support.Greatly appreciated!

   Read on wp.org ↗
4. ★★★★★ marco4422

   2mo ago

   Woocommerce offers a great support team, the can help you if you have any trouble or issue with wordpress or woocommerce. They answer in short time, in my case in 1 days. 5 stars

   Read on wp.org ↗
5. ★★★★★ icpte2024

   2mo ago

   Thanks Frank Remmy for his support on 25/05/2026 for our issue!

   Read on wp.org ↗
6. ★★★★★ cllamsupport

   2mo ago

   Great Plugin

   Read on wp.org ↗
7. ★★★★★ krakanosh

   2mo ago

   Плагин стабильно обновляется каждый месяц, а что в нем меняется – НИЧЕГО! Кроме мусорных функций или обновлений ради обновлений ничего не меняется. Баги не исправляются коих не малое количество, зато с лихвой заносятся новые. Десять раз подумайте прежде чем делать интернет-магазин на WooCommerce. Лучше использовать другой инструмент для создания магазина, благо сейчас их достаточное количество, в том числе open-source.

   Read on wp.org ↗
8. ★★★★★ Robby Barnes

   2mo ago

   I ran into a problem with my site that my theme’s developers weren’t able to help me solve, so I tried the WooCommerce support forum. Within a day I received a thoughtful, detailed response… which also gave me enough info to solve the problem. Much appreciated!

   Read on wp.org ↗

Recent releases and news for this plugin

1. 2026-08-18 WooCommerce 11.1: What’s coming for developers Pre-release notes for WooCommerce 11.1 have dropped! The REST API has a new refund endpoint, right of withdrawal is available for EU users, and variable products get some performance improvements! The 11.1
2. 2026-08-18 Reserved item meta keys are no longer persisted in the admin In WooCommerce 11.0.0, reserved order item meta keys added via the Add meta button are no longer saved in the admin, preventing unstable behavior and keeping internal order data consistent. The post R
3. 2026-08-10 WooCommerce 11.0.1 Release Notes WooCommerce 11.0.1 has been released with targeted fixes for security, WordPress 7.1 compatibility, Store API behavior, analytics validation, and logging performance. The post WooCommerce 11.0.1 Relea 11.0.1
4. 2026-08-06 August Office Hours: WCUS and WooCommerce Foundations Join our August Developer Office Hours to compare notes from WordCamp US and discuss the first weeks of WooCommerce's renewed focus on core performance, reliability, extensibility, and developer exper
5. 2026-08-06 Security update for Stripe for WooCommerce Please update Stripe for WooCommerce for the latest security update. The post Security update for Stripe for WooCommerce appeared first on The WooCommerce Developer Blog .
6. 2026-08-06 Introducing Reconciliation Reports for WooPayments WooPayments is introducing Reconciliation Reports that explain how the balance moves from the start to the end of the specified period. The post Introducing Reconciliation Reports for WooPayments appe

44 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. Medium · 4.3 WooCommerce < 10.5.3 - Cross-Site Request Forgery ↗
   2026-03-10 CVE-2026-3589 Cross-Site Request Forgery (CSRF) Affects < 10.5.3 Patched in 10.5.3
2. Medium · 4.3 WooCommerce <= 10.4.2 - Authenticated (Subscriber+) Information Exposure ↗
   2025-12-22 CVE-2025-15033 Exposure of Sensitive Information to an Unauthorized Actor Affects 10.0 - 10.0.4 Patched in 10.0.5
3. Medium · 4.4 WooCommerce <= 10.0.2 - Authenticated (Shop manager+) Stored Cross-Site Scripting ↗
   2025-10-29 CVE-2025-49042 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 10.0.2 Patched in 10.0.3
4. Medium · 6.1 WooCommerce <= 9.4.2 - PostMessage-Based Cross-Site Scripting ↗
   2025-05-21 CVE-2025-5062 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 9.3.2 Patched in 9.3.4
5. Medium · 4.4 WooCommerce <= 9.7.0 - Authenticated (Shop Manager+) Stored Cross-Site Scripting ↗
   2025-03-12 CVE-2025-26762 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 9.7.0 Patched in 9.7.1
6. Medium · 5.3 WooCommerce <= 9.0.2 - Unauthenticated HTML Injection ↗
   2024-10-14 CVE-2024-9944 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 9.0.2 Patched in 9.1.0
7. Medium · 4.4 WooCommerce <= 9.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
   2024-08-16 CVE-2024-39666 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 9.1.2 Patched in 9.1.3
8. Low · 2.7 WooCommerce <= 8.9.2 - Authenticated (Shop Manager+) Content Injection ↗
   2024-06-27 CVE-2024-35777 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Affects <= 8.9.2 Patched in 9.0.0
9. Medium · 6.1 WooCommerce 8.8.0 - 8.9.2 - Reflected Cross-Site Scripting via Order Attribution ↗
   2024-06-10 CVE-2024-37297 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects 8.8.0 - 8.8.4 Patched in 8.8.5
10. Medium · 4.3 WooCommerce <= 8.5.2 - Cross-Site Request Forgery ↗
    2024-04-05 CVE-2024-22155 Cross-Site Request Forgery (CSRF) Affects <= 8.5.2 Patched in 8.6.0
11. Medium · 6.1 WooCommerce < 8.4.0 - Reflected Cross-Site Scripting ↗
    2024-01-12 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 8.4.0 Patched in 8.4.0
12. Medium · 4.3 WooCommerce <= 8.2.2 - Cross-Site Request Forgery ↗
    2024-01-05 CVE-2023-52222 Cross-Site Request Forgery (CSRF) Affects <= 8.2.2 Patched in 8.3.0
13. Medium · 6.4 WooCommerce <= 8.1.1 & WooCommerce Blocks <= 11.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Featured Image alt Attribute ↗
    2023-11-15 CVE-2023-47777 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 8.1.1 Patched in 8.2.0
14. Medium · 5.3 WooCommerce <= 7.8.2 - Sensitive Information Exposure ↗
    2023-09-11 CVE-2023-7320 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 7.8.2 Patched in 7.9.0
15. Medium · 4.9 WooCommerce <= 7.0.0 - Authenticated(Shop Manager+) Sensitive Information Exposure ↗
    2023-09-11 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 7.0.0 Patched in 7.0.1
16. Medium · 5.5 WooCommerce <= 6.5.1 - Authenticated (Admin+) HTML Injection ↗
    2022-06-20 CVE-2022-2099 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 6.6.0 Patched in 6.6.0
17. Medium · 6.5 WooCommerce < 5.7.0 & WooCommerce Admin < 2.6.4 - Information Disclosure ↗
    2022-04-10 Exposure of Sensitive Information to an Unauthorized Actor Affects < 4.0 Patched in 4.0.3
18. Medium · 4.3 WooCommerce < 6.3.1 - Unauthorized Order Status Change ↗
    2022-03-10 Missing Authorization Affects 3.5 - 3.5.10 Patched in 3.5.10
19. Medium · 5.4 WooCommerce <= 6.2.0 - Incorrect Authorization Checks on REST API Endpoints ↗
    2022-02-22 CVE-2022-0775 Improper Authorization Affects <= 6.2.0 Patched in 6.2.1
20. High · 7.2 WooCommerce <= 6.2.0 - Path Traversal via Tax Importer ↗
    2022-02-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects <= 6.2.0 Patched in 6.2.1
21. High · 8.8 WooCommerce < 5.5 - Authenticated Blind SQL Injection ↗
    2021-07-13 CVE-2021-32790 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects < 3.3 Patched in 3.3.6
22. Medium · 4.8 WooCommerce <= 5.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2021-04-21 CVE-2021-24323 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 5.2.0 Patched in 5.2.0
23. Medium · 6.5 WooCommerce <= 4.6.1 & WooCommerce Blocks <= 3.7.0 - Settings Bypass leading to Account Creation ↗
    2020-11-05 Missing Authorization Affects < 4.6.2 Patched in 4.6.2
24. Medium · 6.1 WooCommerce <= 4.2.0 - Reflected Cross-Site Scripting ↗
    2020-06-22 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 4.2.1 Patched in 4.2.1
25. High · 8.8 WooCommerce <= 4.0.4 - Unauthorized Post Meta Creation/Modification ↗
    2020-05-05 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects < 4.1.0 Patched in 4.1.0
26. Medium · 5.3 WooCommerce < 4.7.0 - Insecure Direct Object Reference via order_id Parameter ↗
    2020-01-21 CVE-2020-29156 Authorization Bypass Through User-Controlled Key Affects < 4.7.0 Patched in 4.7.0
27. High · 7.2 WooCommerce <= 3.6.4 - Missing File Type Validation ↗
    2019-07-02 Unrestricted Upload of File with Dangerous Type Affects <= 3.6.4 Patched in 3.6.5
28. High · 8.8 WooCommerce <= 3.6.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting ↗
    2019-07-02 Cross-Site Request Forgery (CSRF) Affects < 3.6.5 Patched in 3.6.5
29. Medium · 6.1 WooCommerce <= 3.5.4 - Stored Cross-Site Scripting ↗
    2019-02-20 CVE-2019-9168 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 3.5.5 Patched in 3.5.5
30. Medium · 5.5 WooCommerce <= 3.5.1 - Authenticated Stored Cross-Site Scripting ↗
    2018-11-29 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.5.1 Patched in 3.5.2
31. High · 7.2 WooCommerce <= 3.4.5 - WooCommerce File Deletion ↗
    2018-11-06 CVE-2018-20714 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects < 3.4.6 Patched in 3.4.6
32. Medium · 6.6 WooCommerce <= 3.4.4 - Authenticated PHP Object Injection ↗
    2018-08-29 Deserialization of Untrusted Data Affects < 3.4.5 Patched in 3.4.5
33. High · 8.8 WooCommerce <= 3.2.3 - Authenticated PHP Object Injection ↗
    2017-11-16 CVE-2017-18356 Improper Control of Generation of Code ('Code Injection') Affects < 3.2.4 Patched in 3.2.4
34. Medium · 5.5 WooCommerce <= 2.6.8 - Authenticated Stored Cross-Site Scripting ↗
    2016-12-07 CVE-2016-10112 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 2.6.9 Patched in 2.6.9
35. Medium · 6.4 WooCommerce <= 2.6.3 - Stored Cross-Site Scripting via REST-API ↗
    2016-07-26 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 2.6.4 Patched in 2.6.4
36. Medium · 6.4 WooCommerce <= 2.6.2 - Stored Cross-Site Scripting ↗
    2016-07-19 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 2.6.3 Patched in 2.6.3
37. Medium · 5.5 WooCommerce < 2.4.9 - Cross-site Scripting ↗
    2015-11-17 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 2.4.9 Patched in 2.4.9
38. High · 7.5 WooCommerce <= 2.3.10 - PHP Object Injection ↗
    2015-06-10 Deserialization of Untrusted Data Affects <= 2.3.10 Patched in 2.3.11
39. High · 7.2 WooCommerce <= 2.3.5 - Stored Cross-Site Scripting ↗
    2015-03-13 CVE-2015-2329 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 2.3.6 Patched in 2.3.6
40. Medium · 6.1 WooCommerce <= 2.2.10 - Cross-Site Scripting ↗
    2015-01-29 CVE-2015-2069 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 2.2.11 Patched in 2.2.11
41. Medium · 6.1 WooCommerce <= 2.2.2 - Reflected Cross-Site Scripting ↗
    2014-09-17 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 2.2.3 Patched in 2.2.3
42. High · 7.3 WooCommerce <= 2.2.2 - Cross-Site Scripting via range Parameter ↗
    2014-09-15 CVE-2014-6313 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 2.2.3 Patched in 2.2.3
43. Medium · 6.1 WooCommerce <= 2.0.17 - Cross-Site Scripting ↗
    2013-10-17 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.0.17 Patched in 2.0.18
44. Medium · 6.1 WooCommerce <= 2.0.12 - Self-Reflected Cross-Site Scripting ↗
    2013-07-18 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.0.12 Patched in 2.0.13

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Translated into 103 languages, 41 at 90% or more

Plus 79 more locales with partial translations.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2025-06-20 8M+ → 7M+ down after 124 days in tier
2. 2025-02-16 7M+ → 8M+ up after 26 days in tier
3. 2025-01-21 8M+ → 7M+ down after 90 days in tier
4. 2024-10-23 7M+ → 8M+ up after 152 days in tier
5. 2024-05-24 5M+ → 7M+ up

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• Simple Shopping Cart 10K+ installs · 4.5★ · 4 shared tags A
• Ecwid by Lightspeed Ecommerce Shopping Cart 20K+ installs · 4.5★ · 3 shared tags A
• BigCommerce For WordPress 300+ installs · 3.9★ · 3 shared tags C
• TI WooCommerce Wishlist 100K+ installs · 4.7★ · 2 shared tags A
• SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments 80K+ installs · 4.7★ · 2 shared tags A
• StoreCustomizer – A plugin to Customize all WooCommerce Pages 20K+ installs · 4.7★ · 2 shared tags A

Embed this report card

Drop a live Pulse card for WooCommerce into a readme, a review or a deck. It updates itself.

WooCommerce: 7M+ active installs, 4.5★ (4,819 reviews). Plugin Pulse (WP Mayor), as of 2026-08-25. https://plugins.wpmayor.com/plugin/woocommerce