Plugin Pulse Beta
← Pulse

WooCommerce

by Automattic · eCommerce

Also makes 78 other plugins · 18.1M+ installs across the portfolio →

Try it live ↗ wp.org ↗

Everything you need to launch an online store in days and keep it growing for years. From your first sale to millions in revenue, Woo is with you.

Try it live opens a temporary test site in your browser, which can take about 20 seconds to load. Plugins that rely on outside services or a full server may not work completely there.

Health

A 90/100

no flags

Active installs

7M+

≈7.5M estimated

Momentum

-12%

downloads vs prior 30d

Biggest opportunity: Support resolution scores 81/100. Mark more forum threads resolved — the resolved ratio feeds the ranking.

See the detail → Get the free audit
How scoring works →
90 Health · A
Maintenance 100/100
Rating quality 89/100
Support 87/100
Security 75/100

90 health vs 71 average across 9,824 eCommerce plugins

7M+

Active installs

≈7.5M estimated

471.4M

Total downloads

since 2011 · 1.5% still active

4.5/5

Rating

4,833 reviews · +1.8/wk

-12%

5.1M

Downloads · 30d

category median +2%

Install conversion

How it's measured →

1.5%

of downloads still active

At least 7M of 471.4M lifetime downloads are still running, in line with its category: the median eCommerce plugin keeps 1.4%, across 5,168 plugins.

Downloads count every update, not just first installs, so older and more frequently released plugins read lower. Compare against other eCommerce plugins, not across the directory. wp.org reports active installs as the bottom of a band, so the real rate is this or higher.

This plugin shipped 134 releases in the last 12 months, and every existing install that updated counted as another download. wp.org publishes no split between first installs and updates, so we show the raw rate rather than guess at one.

Ratings · 4833 reviews

Read on wp.org ↗
5★
4005 4★
197 3★
113 2★
108 1★
410

Details

Version
11.2.1
Last updated
25d ago
Added
2011-09-27 · 15 yrs old
Requires WP
7.0
Tested up to
7.1.4
Requires PHP
7.4
Changelog ↗Support forum ↗Reviews ↗Advanced stats ↗

Directory ranking optimization

How it's scored →

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

95 / 100

Excellent listing optimization

Well tuned across the board

Update recency 100/100

Updated 25 days ago

WP compatibility 100/100

Tested up to WordPress 7.1.4, the current branch or newer

Rating quality 90/100

4.5★ over 4,833 reviews, weighted for review count to 4.5★

Listing tuning 100/100

5 of 5 tags set · short description in place

Support resolution 81/100

98 of 121 support threads resolved in the last 2 months

Daily downloads

Since 5 Oct 2022 · 1,491 days · wp.org + Plugin Pulse archive

-12% vs prior 30d
54.3K3 Nov 2026

30-day downloads

Rolling 30-day volume · peak 11.6M · peaks are release surges

5.1M3 Nov 2026

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

WooCommerce · #6youSimple Shopping Cart · #1815WP EasyCart: Shoppin · #3686Total Sales Counts f · #7966

Health trend

Composite health score, snapshotted daily

903 Nov 2026

Update activity

How busy the existing users are, measured as downloads in the last 30 days for every 1,000 active sites. A spike means a new release everyone's pulling; a long, slow decline means an aging user base that updates less.

7263 Nov 2026

Release cadence

Actively maintained
from wp.org release tags

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

134

releases in the last 12 months

25d ago

latest release · v11.2.1 · 9 Oct 2026

654

tagged releases on record

Recent releases

11.2.1 · 9 Oct 202611.2.0 · 7 Oct 202611.2.0-rc.1 · 5 Oct 202611.2.0-beta.2 · 28 Sep 202611.1.2 · 22 Sep 202611.2.0-beta.1 · 21 Sep 202611.1.1 · 18 Sep 202611.1.0 · 3 Sep 202611.1.0-rc.2 · 2 Sep 202611.1.0-rc.1 · 31 Aug 202611.1.0-beta.2 · 25 Aug 202611.1.0-beta.1 · 18 Aug 202611.0.1 · 10 Aug 202611.0.0 · 4 Aug 2026

What its installed base runs

via wordpress.org

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

v10.9 30%
v10.7 13%
v10.8 7%
v10.3 5.5%
Older / other versions 45%

Estimated active installs

The public count shows “7M+”. Our estimate pins where the real number sits.

tracked estimate
7M–8M ≈7.5M

Crossed into this band 17 months ago; a band this size takes about a year or more to cross, which places it about 50% of the way through.

Install history since 1 Jan 2022

7M3 Nov 2026

Recent reviews

All reviews on wp.org ↗
  1. ★★★★★ louisenglish1990
    4mo ago

    Absolutley excellent feedback, I spoke with our admin team and there was a filter applied in the background that was not allowing me to search. Thank you for all of your help

    Read on wp.org ↗
  2. ★★★★★ jimk1416
    4mo ago

    very quick and reliable support if you have any issues

    Read on wp.org ↗
  3. ★★★★★ wopodk
    4mo ago

    Extremely helpful and fast support.Greatly appreciated!

    Read on wp.org ↗
  4. ★★★★★ marco4422
    4mo ago

    Woocommerce offers a great support team, the can help you if you have any trouble or issue with wordpress or woocommerce. They answer in short time, in my case in 1 days. 5 stars

    Read on wp.org ↗
  5. ★★★★★ icpte2024
    4mo ago

    Thanks Frank Remmy for his support on 25/05/2026 for our issue!

    Read on wp.org ↗
  6. ★★★★★ cllamsupport
    4mo ago

    Great Plugin

    Read on wp.org ↗
  7. ★★★★★ krakanosh
    4mo ago

    Плагин стабильно обновляется каждый месяц, а что в нем меняется – НИЧЕГО! Кроме мусорных функций или обновлений ради обновлений ничего не меняется. Баги не исправляются коих не малое количество, зато с лихвой заносятся новые. Десять раз подумайте прежде чем делать интернет-магазин на WooCommerce. Лучше использовать другой инструмент для создания магазина, благо сейчас их достаточное количество, в том числе open-source.

    Read on wp.org ↗
  8. ★★★★★ Robby Barnes
    5mo ago

    I ran into a problem with my site that my theme’s developers weren’t able to help me solve, so I tried the WooCommerce support forum. Within a day I received a thoughtful, detailed response… which also gave me enough info to solve the problem. Much appreciated!

    Read on wp.org ↗

Latest updates

via official blog

Recent releases and news for this plugin

  1. 2026-10-27 Declaring parent-child cart item relationships in WooCommerce 11.3 WooCommerce 11.3 introduces a filter for tracking product relationships in the cart, enhancing accurate "N in cart" counts for bundled items and extensions. The post Declaring parent-child cart item r 11.3
  2. 2026-10-26 WooCommerce 11.3: What’s coming for developers WooCommerce 11.3 beta is now available for testing, featuring enhanced styling controls, On-Sale Badge improvements, mobile gallery updates, and improvements to MCP. The post WooCommerce 11.3: What’s 11.3
  3. 2026-10-22 Call for testing: Extensible abilities for extension fields WooCommerce 11.3 introduces an experimental API enabling extensions to add their data to WooCommerce MCP Abilities The post Call for testing: Extensible abilities for extension fields appeared first o
  4. 2026-10-21 WooCommerce 11.3 MCP Adaptor updates WooCommerce 11.3 removes its deprecated MCP endpoint. Learn how to move MCP clients and extensions to the WordPress MCP Adapter. The post WooCommerce 11.3 MCP Adaptor updates appeared first on The Woo 11.3
  5. 2026-10-21 Critical Security Releases for PHP The PHP project has announced a security release that fixes two critical security vulnerabilities discovered in PHP. Store owners are encouraged to immediately update their installations of PHP. The p
  6. 2026-10-20 Purple development moves to the WooCommerce monorepo The Purple theme development has transitioned to the WooCommerce monorepo, enhancing collaboration and maintenance while remaining a standalone WordPress theme with independent releases. The post Purp

Security history

via Wordfence Intelligence

All 47 disclosed vulnerabilities are patched in the current version (11.2.1). Sites still on an older version should update.

  1. Patched Medium · 4.7 WooCommerce 9.8.0 - 11.1.2 - Authenticated (Shop Manager+) Privilege Escalation ↗
    2026-10-08 CVE-2026-106608 Improper Privilege Management Affects 9.8.0 - 11.1.2 Patched in 11.2.0
  2. Patched High · 7.5 WooCommerce < 11.1.0 - Unauthenticated Denial of Service ↗
    2026-09-07 CVE-2026-48888 Uncontrolled Resource Consumption Affects < 11.1.0 Patched in 11.1.0
  3. Patched Medium · 4.9 WooCommerce <= 10.9.4 - Authenticated (Shop Manager+) SQL Injection ↗
    2026-09-04 CVE-2026-57777 Improper Neutralization of Special Elements used in an SQL Command Affects <= 10.9.4 Patched in 11.0
  4. Patched Medium · 4.3 WooCommerce < 10.5.3 - Cross-Site Request Forgery ↗
    2026-03-10 CVE-2026-3589 Cross-Site Request Forgery Affects < 10.5.3 Patched in 10.5.3
  5. Patched Medium · 4.3 WooCommerce <= 10.4.2 - Authenticated (Subscriber+) Information Exposure ↗
    2025-12-22 CVE-2025-15033 Exposure of Sensitive Information to an Unauthorized Actor Affects 10.0 - 10.0.4 Patched in 10.0.5
  6. Patched Medium · 4.4 WooCommerce <= 10.0.2 - Authenticated (Shop manager+) Stored Cross-Site Scripting ↗
    2025-10-29 CVE-2025-49042 Improper Neutralization of Input During Web Page Generation Affects <= 10.0.2 Patched in 10.0.3
  7. Patched Medium · 6.1 WooCommerce <= 9.4.2 - PostMessage-Based Cross-Site Scripting ↗
    2025-05-21 CVE-2025-5062 Improper Neutralization of Input During Web Page Generation Affects <= 9.3.2 Patched in 9.3.4
  8. Patched Medium · 4.4 WooCommerce <= 9.7.0 - Authenticated (Shop Manager+) Stored Cross-Site Scripting ↗
    2025-03-12 CVE-2025-26762 Improper Neutralization of Input During Web Page Generation Affects <= 9.7.0 Patched in 9.7.1
  9. Patched Medium · 5.3 WooCommerce <= 9.0.2 - Unauthenticated HTML Injection ↗
    2024-10-14 CVE-2024-9944 Improper Neutralization of Input During Web Page Generation Affects <= 9.0.2 Patched in 9.1.0
  10. Patched Medium · 4.4 WooCommerce <= 9.1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
    2024-08-16 CVE-2024-39666 Improper Neutralization of Input During Web Page Generation Affects <= 9.1.2 Patched in 9.1.3
  11. Patched Low · 2.7 WooCommerce <= 8.9.2 - Authenticated (Shop Manager+) Content Injection ↗
    2024-06-27 CVE-2024-35777 Improper Neutralization of Special Elements in Output Used by a Downstream Component Affects <= 8.9.2 Patched in 9.0.0
  12. Patched Medium · 6.1 WooCommerce 8.8.0 - 8.9.2 - Reflected Cross-Site Scripting via Order Attribution ↗
    2024-06-10 CVE-2024-37297 Improper Neutralization of Input During Web Page Generation Affects 8.8.0 - 8.8.4 Patched in 8.8.5
  13. Patched Medium · 4.3 WooCommerce <= 8.5.2 - Cross-Site Request Forgery ↗
    2024-04-05 CVE-2024-22155 Cross-Site Request Forgery Affects <= 8.5.2 Patched in 8.6.0
  14. Patched Medium · 6.1 WooCommerce < 8.4.0 - Reflected Cross-Site Scripting ↗
    2024-01-12 Improper Neutralization of Input During Web Page Generation Affects < 8.4.0 Patched in 8.4.0
  15. Patched Medium · 4.3 WooCommerce <= 8.2.2 - Cross-Site Request Forgery ↗
    2024-01-05 CVE-2023-52222 Cross-Site Request Forgery Affects <= 8.2.2 Patched in 8.3.0
  16. Patched Medium · 6.4 WooCommerce <= 8.1.1 & WooCommerce Blocks <= 11.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Featured Image alt Attribute ↗
    2023-11-15 CVE-2023-47777 Improper Neutralization of Input During Web Page Generation Affects <= 8.1.1 Patched in 8.2.0
  17. Patched Medium · 5.3 WooCommerce <= 7.8.2 - Sensitive Information Exposure ↗
    2023-09-11 CVE-2023-7320 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 7.8.2 Patched in 7.9.0
  18. Patched Medium · 4.9 WooCommerce <= 7.0.0 - Authenticated(Shop Manager+) Sensitive Information Exposure ↗
    2023-09-11 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 7.0.0 Patched in 7.0.1
  19. Patched Medium · 5.5 WooCommerce <= 6.5.1 - Authenticated (Admin+) HTML Injection ↗
    2022-06-20 CVE-2022-2099 Improper Neutralization of Input During Web Page Generation Affects < 6.6.0 Patched in 6.6.0
  20. Patched Medium · 6.5 WooCommerce < 5.7.0 & WooCommerce Admin < 2.6.4 - Information Disclosure ↗
    2022-04-10 Exposure of Sensitive Information to an Unauthorized Actor Affects < 4.0 Patched in 4.0.3
  21. Patched Medium · 4.3 WooCommerce < 6.3.1 - Unauthorized Order Status Change ↗
    2022-03-10 Missing Authorization Affects 3.5 - 3.5.10 Patched in 3.5.10
  22. Patched Medium · 5.4 WooCommerce <= 6.2.0 - Incorrect Authorization Checks on REST API Endpoints ↗
    2022-02-22 CVE-2022-0775 Improper Authorization Affects <= 6.2.0 Patched in 6.2.1
  23. Patched High · 7.2 WooCommerce <= 6.2.0 - Path Traversal via Tax Importer ↗
    2022-02-22 Improper Limitation of a Pathname to a Restricted Directory Affects <= 6.2.0 Patched in 6.2.1
  24. Patched High · 8.8 WooCommerce < 5.5 - Authenticated Blind SQL Injection ↗
    2021-07-13 CVE-2021-32790 Improper Neutralization of Special Elements used in an SQL Command Affects < 3.3 Patched in 3.3.6
  25. Patched Medium · 4.8 WooCommerce <= 5.1.3 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2021-04-21 CVE-2021-24323 Improper Neutralization of Input During Web Page Generation Affects < 5.2.0 Patched in 5.2.0
  26. Patched Medium · 6.5 WooCommerce <= 4.6.1 & WooCommerce Blocks <= 3.7.0 - Settings Bypass leading to Account Creation ↗
    2020-11-05 Missing Authorization Affects < 4.6.2 Patched in 4.6.2
  27. Patched Medium · 6.1 WooCommerce <= 4.2.0 - Reflected Cross-Site Scripting ↗
    2020-06-22 Improper Neutralization of Input During Web Page Generation Affects < 4.2.1 Patched in 4.2.1
  28. Patched High · 8.8 WooCommerce <= 4.0.4 - Unauthorized Post Meta Creation/Modification ↗
    2020-05-05 Improper Neutralization of Special Elements used in an SQL Command Affects < 4.1.0 Patched in 4.1.0
  29. Patched Medium · 5.3 WooCommerce < 4.7.0 - Insecure Direct Object Reference via order_id Parameter ↗
    2020-01-21 CVE-2020-29156 Authorization Bypass Through User-Controlled Key Affects < 4.7.0 Patched in 4.7.0
  30. Patched High · 7.2 WooCommerce <= 3.6.4 - Missing File Type Validation ↗
    2019-07-02 Unrestricted Upload of File with Dangerous Type Affects <= 3.6.4 Patched in 3.6.5
  31. Patched High · 8.8 WooCommerce <= 3.6.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting ↗
    2019-07-02 Cross-Site Request Forgery Affects < 3.6.5 Patched in 3.6.5
  32. Patched Medium · 6.1 WooCommerce <= 3.5.4 - Stored Cross-Site Scripting ↗
    2019-02-20 CVE-2019-9168 Improper Neutralization of Input During Web Page Generation Affects < 3.5.5 Patched in 3.5.5
  33. Patched Medium · 5.5 WooCommerce <= 3.5.1 - Authenticated Stored Cross-Site Scripting ↗
    2018-11-29 Improper Neutralization of Input During Web Page Generation Affects <= 3.5.1 Patched in 3.5.2
  34. Patched High · 7.2 WooCommerce <= 3.4.5 - WooCommerce File Deletion ↗
    2018-11-06 CVE-2018-20714 Improper Limitation of a Pathname to a Restricted Directory Affects < 3.4.6 Patched in 3.4.6
  35. Patched Medium · 6.6 WooCommerce <= 3.4.4 - Authenticated PHP Object Injection ↗
    2018-08-29 Deserialization of Untrusted Data Affects < 3.4.5 Patched in 3.4.5
  36. Patched High · 8.8 WooCommerce <= 3.2.3 - Authenticated PHP Object Injection ↗
    2017-11-16 CVE-2017-18356 Improper Control of Generation of Code Affects < 3.2.4 Patched in 3.2.4
  37. Patched Medium · 5.5 WooCommerce <= 2.6.8 - Authenticated Stored Cross-Site Scripting ↗
    2016-12-07 CVE-2016-10112 Improper Neutralization of Input During Web Page Generation Affects < 2.6.9 Patched in 2.6.9
  38. Patched Medium · 6.4 WooCommerce <= 2.6.3 - Stored Cross-Site Scripting via REST-API ↗
    2016-07-26 Improper Neutralization of Input During Web Page Generation Affects < 2.6.4 Patched in 2.6.4
  39. Patched Medium · 6.4 WooCommerce <= 2.6.2 - Stored Cross-Site Scripting ↗
    2016-07-19 Improper Neutralization of Input During Web Page Generation Affects < 2.6.3 Patched in 2.6.3
  40. Patched Medium · 5.5 WooCommerce < 2.4.9 - Cross-site Scripting ↗
    2015-11-17 Improper Neutralization of Input During Web Page Generation Affects < 2.4.9 Patched in 2.4.9
  41. Patched High · 7.5 WooCommerce <= 2.3.10 - PHP Object Injection ↗
    2015-06-10 Deserialization of Untrusted Data Affects <= 2.3.10 Patched in 2.3.11
  42. Patched High · 7.2 WooCommerce <= 2.3.5 - Stored Cross-Site Scripting ↗
    2015-03-13 CVE-2015-2329 Improper Neutralization of Input During Web Page Generation Affects < 2.3.6 Patched in 2.3.6
  43. Patched Medium · 6.1 WooCommerce <= 2.2.10 - Cross-Site Scripting ↗
    2015-01-29 CVE-2015-2069 Improper Neutralization of Input During Web Page Generation Affects < 2.2.11 Patched in 2.2.11
  44. Patched Medium · 6.1 WooCommerce <= 2.2.2 - Reflected Cross-Site Scripting ↗
    2014-09-17 Improper Neutralization of Input During Web Page Generation Affects < 2.2.3 Patched in 2.2.3
  45. Patched High · 7.3 WooCommerce <= 2.2.2 - Cross-Site Scripting via range Parameter ↗
    2014-09-15 CVE-2014-6313 Improper Neutralization of Input During Web Page Generation Affects < 2.2.3 Patched in 2.2.3
  46. Patched Medium · 6.1 WooCommerce <= 2.0.17 - Cross-Site Scripting ↗
    2013-10-17 Improper Neutralization of Input During Web Page Generation Affects <= 2.0.17 Patched in 2.0.18
  47. Patched Medium · 6.1 WooCommerce <= 2.0.12 - Self-Reflected Cross-Site Scripting ↗
    2013-07-18 Improper Neutralization of Input During Web Page Generation Affects <= 2.0.12 Patched in 2.0.13

Vulnerability records provided by Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. License and terms.

CVE records: Copyright 1999-2026 The MITRE Corporation. CVE terms of use.

Languages

via translate.wordpress.org

Translated into 103 languages, 42 at 90% or more

Arabic 100%
Chinese (China) 100%
Chinese (Taiwan) 100%
Czech 100%
Dutch 100%
English (UK) 100%
Faroese 100%
French (France) 100%
Galician 100%
German 100%
Hebrew 100%
Indonesian 100%
Italian 100%
Japanese 100%
Korean 100%
Kurdish (Sorani) 100%
Polish 100%
Portuguese (Brazil) 100%
Romanian 100%
Russian 100%
Serbian 100%
Spanish (Mexico) 100%
Spanish (Spain) 100%
Turkish 100%

Plus 79 more locales with partial translations.

AI assistants

How it's measured →

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Premium

Share of voice

How often each assistant names WooCommerce when asked about these topics, where it comes in the answer, and how that compares with its wp.org search position. Latest run 1 Nov 2026.

Assistants
ChatGPT, Claude
Topics tracked
SEO, Ecommerce, WooCommerce extensions, Membership, Performance
Get early access to Premium →

Readme readiness

6 of 8 pass · checked 2 Nov 2026

Can an assistant quote this readme? Eight deterministic checks over the wp.org listing, no model involved.

  • ! Says what it does Short description names no action; say what the plugin does for the site.
  • ✓ Has a FAQ 12 questions in the FAQ.
  • ✓ FAQ asks real questions 12 of 12 read like questions a user would type.
  • ! Names who it is for Never says who the plugin is for or what they use it for.
  • ✓ Names what it works with Mentions WooCommerce, Mailchimp, HubSpot, Stripe and 4 more.
  • ✓ Headings and lists 7 headings and 3 lists.
  • ✓ Enough to quote 5,534 characters of description.
  • ✓ Tags match the text 4 of 5 tags appear in the text; "sell online" does not.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

  1. 2025-06-20 8M+ → 7M+ down after 124 days in tier
  2. 2025-02-16 7M+ → 8M+ up after 26 days in tier
  3. 2025-01-21 8M+ → 7M+ down after 90 days in tier
  4. 2024-10-23 7M+ → 8M+ up after 152 days in tier
  5. 2024-05-24 5M+ → 7M+ up after 1666 days in tier
  6. 2019-11-01 4M+ → 5M+ up after 518 days in tier
  7. 2018-06-01 3M+ → 4M+ up after 426 days in tier
  8. 2017-04-01 2M+ → 3M+ up after 31 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for WooCommerce into a readme, a review or a deck. It updates itself.

<iframe src="https://plugins.wpmayor.com/embed/woocommerce" width="480" height="300" style="border:0" loading="lazy" title="WooCommerce — Plugin Pulse"></iframe>
Preview card ↗

WooCommerce: 7M+ active installs, 4.5★ (4,833 reviews). Plugin Pulse (WP Mayor), as of 2026-11-03. https://plugins.wpmayor.com/plugin/woocommerce

Spotted a number that looks wrong? Report a data issue and we'll check it against the source.