Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price.

Recent releases and news for this plugin

1. — Version 8.1.0 Checkout Blocks compatibility – Added supported Checkout Custom Fields to Blocks checkout with server-side validation, order saving, and module-specific product, category, and cart visibility on supported WooCommerce ver 8.1.0
2. — Version 8.0.2 Security – Hardened Product by User media upload handling and Free tier upload boundaries. Security hardening – Strengthened related customer upload validation in Checkout Files Upload and Product Input Fields. Continuou 8.0.2
3. — Version 8.0.1 Faster Sales Notifications – The recent-purchase popup is now noticeably lighter on busy stores. Booster reuses the most recent result for a short window instead of querying your orders on every popup cycle, cutting data 8.0.1
4. — Version 8.0.0 Feature – WooCommerce Blocks: Checkout Custom Fields — radio fields automatically converted to select dropdowns on Blocks checkout. Batch option loading eliminates N+1 queries during field registration. Feature – WooComm 8.0.0
5. — Version 7.11.5 Feature – WooCommerce Blocks: Added support for Checkout Custom Fields (Text, Select, and Checkbox) via the WC Additional Checkout Fields API. Enhancement – Performance: Optimized Admin JS loading; wcj-admin.js is now sc 7.11.5
6. — Version 7.11.4 Normalized in-plugin upsell routing so generic compare-first prompts route to /free-vs-elite/ while explicit buy/pricing CTAs stay on /buy-booster/. Kept upgrade-block comparison buttons and other ambiguous/tag-first doc 7.11.4

38 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. High · 8.8 Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools <= 8.0.1 - Authenticated (Customer+) Arbitrary File Upload ↗
   2026-06-23 CVE-2026-56027 Unrestricted Upload of File with Dangerous Type Affects <= 8.0.1 Patched in 8.0.2
2. Medium · 5.3 Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools < 7.11.3 - Missing Authorization ↗
   2026-03-17 CVE-2026-32586 Missing Authorization Affects < 7.11.3 Patched in 7.11.3
3. Medium · 4.3 Booster for WooCommerce <= 7.4.0 - Missing Authorization ↗
   2025-10-30 CVE-2025-64379 Missing Authorization Affects <= 7.4.0 Patched in 7.5.0
4. Medium · 6.4 Booster for WooCommerce <= 7.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
   2025-10-18 CVE-2025-64380 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 7.3.2 Patched in 7.4.0
5. High · 8.1 Booster for WooCommerce <= 7.2.4 - Unauthenticated Double Extension Arbitrary File Upload ↗
   2025-08-28 CVE-2024-13342 Unrestricted Upload of File with Dangerous Type Affects <= 7.2.4 Patched in 7.2.5
6. Medium · 6.1 Booster for WooCommerce <= 7.2.5 - Reflected Cross-Site Scripting ↗
   2025-04-22 CVE-2025-64196 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 7.2.5 Patched in 7.2.6
7. High · 7.2 Booster for WooCommerce 4.0.1 - 7.2.4 - Unauthenticated Stored Cross-Site Scripting ↗
   2025-04-03 CVE-2024-13708 Unrestricted Upload of File with Dangerous Type Affects 4.0.1 - 7.2.4 Patched in 7.2.5
8. High · 8.1 Booster for WooCommerce 4.0.1 - 7.2.4 - Unauthenticated Arbitrary File Upload ↗
   2025-04-03 CVE-2024-13744 Unrestricted Upload of File with Dangerous Type Affects 4.0.1 - 7.2.4 Patched in 7.2.5
9. High · 7.2 Booster for WooCommerce <= 7.2.4 - Unauthenticated Stored Cross-Site Scripting ↗
   2025-03-31 CVE-2024-12278 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 7.2.4 Patched in 7.2.5
10. Medium · 5.5 Booster for WooCommerce <= 7.2.3 - Authenticated (ShopManager+) Stored Cross-Site Scripting via wcj_product_meta Shortcode ↗
    2024-11-25 CVE-2024-9170 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 7.2.3 Patched in 7.2.4
11. Medium · 6.1 Booster for WooCommerce <= 7.2.3 - Reflected Cross-Site Scripting ↗
    2024-11-19 CVE-2024-9239 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 7.2.3 Patched in 7.2.4
12. Medium · 6.5 Booster for WooCommerce <= 7.1.8 - Unauthenticated Arbitrary Shortcode Execution ↗
    2024-05-01 CVE-2024-3957 Improper Control of Generation of Code ('Code Injection') Affects <= 7.1.8 Patched in 7.1.9
13. Medium · 6.1 Booster for WooCommerce <= 7.1.7 - Reflected Cross-Site Scripting ↗
    2024-03-25 CVE-2024-29760 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 7.1.7 Patched in 7.1.8
14. Medium · 6.4 Booster for WooCommerce <= 7.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortocde ↗
    2024-03-06 CVE-2024-1534 Improper Input Validation Affects <= 7.1.7 Patched in 7.1.8
15. Medium · 6.4 Booster for WooCommerce <= 7.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2024-02-12 CVE-2024-1054 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 7.1.6 Patched in 7.1.7
16. Medium · 4.3 Booster for WooCommerce <= 7.1.2 - Missing Authorization to Product Creation/Modification ↗
    2023-11-24 CVE-2023-48747 Missing Authorization Affects <= 7.1.2 Patched in 7.1.3
17. Medium · 4.3 Booster for WooCommerce <= 7.1.1 - Missing Authorization to Authenticated (Subscriber+) Order Information Disclosure ↗
    2023-11-24 CVE-2023-48333 Missing Authorization Affects <= 7.1.1 Patched in 7.1.2
18. Medium · 6.4 Booster for WooCommerce <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗
    2023-10-18 CVE-2023-5638 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 7.1.2 Patched in 7.1.3
19. Medium · 4.3 Booster for WooCommerce <= 7.1.1 - Authenticated (Subscriber+) Information Disclosure via Shortcode ↗
    2023-10-04 CVE-2023-40002 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 7.1.1 Patched in 7.1.2
20. Medium · 6.4 Booster for WooCommerce <= 7.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗
    2023-09-13 CVE-2023-4945 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 7.1.0 Patched in 7.1.1
21. Medium · 4.3 Booster for WooCommerce <= 7.1.0 - Authenticated (Subscriber+) Information Disclosure via Shortcode ↗
    2023-09-13 CVE-2023-4796 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 7.1.0 Patched in 7.1.1
22. High · 7.2 Booster for WooCommerce 7.0.0 - Authenticated (Shop Manager+) Missing Authorization to Arbitrary Options Update ↗
    2023-08-01 Missing Authorization Affects 7.0.0 Patched in 7.1.0
23. Medium · 5.4 Booster (<= 6.0.0), Booster Plus (<= 6.0.0), and Booster Elite (<= 6.0.0) for WooCommerce - Cross-Site Request Forgery ↗
    2023-01-02 CVE-2022-4017 Cross-Site Request Forgery (CSRF) Affects <= 6.0.0 Patched in 6.0.1
24. Medium · 6.1 Booster (<= 5.6.2), Booster Plus (< 6.0.0), and Booster Elite (< 6.0.0) for WooCommerce - Reflected Cross-Site Scripting ↗
    2022-12-05 CVE-2022-4227 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.6.2 Patched in 5.6.3
25. High · 8.8 Booster for WooCommerce <= 5.6.8 - Cross-Site Request Forgery ↗
    2022-11-30 Cross-Site Request Forgery (CSRF) Affects <= 5.6.8 Patched in 6.0.0
26. Medium · 5.4 Booster (<= 5.6.6), Booster Plus (<= 5.6.5), and Booster Elite (<= 1.1.7) for WooCommerce - Cross-Site Request Forgery leading to Arbitrary Custom Role Creation/Deletion ↗
    2022-11-21 CVE-2022-4016 Cross-Site Request Forgery (CSRF) Affects <= 5.6.6 Patched in 5.6.7
27. High · 8.8 Booster for WooCommerce (Free <= 5.6.6, Premium <= 5.6.4) - Cross-Site Request Forgery to File Deletion ↗
    2022-10-31 CVE-2022-3763 Cross-Site Request Forgery (CSRF) Affects <= 5.6.6 Patched in 5.6.7
28. High · 8.8 Booster for WooCommerce <= 5.6.6 - Cross-Site Request Forgery ↗
    2022-10-27 CVE-2022-41805 Cross-Site Request Forgery (CSRF) Affects <= 5.6.6 Patched in 5.6.7
29. Medium · 6.5 Booster (<= 5.6.6) and Booster Plus (<= 5.6.4) for WooCommerce - Authenticated (Shop Manager+) Information Exposure via Arbitrary File Download ↗
    2022-10-27 CVE-2022-3762 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects <= 5.6.6 Patched in 5.6.7
30. Medium · 6.5 Booster for WooCommerce (Free <= 5.6.2 and Premium <= 5.6.0) - Authenticated (Subscriber+) Order Modification ↗
    2022-09-19 Authorization Bypass Through User-Controlled Key Affects <= 5.6.2 Patched in 5.6.3
31. High · 8.8 Booster for WooCommerce <= 5.6.1 - Cross-Site Request Forgery ↗
    2022-07-27 Cross-Site Request Forgery (CSRF) Affects <= 5.6.1 Patched in 5.6.2
32. Medium · 6.1 Booster for WooCommerce <= 5.5.9 - Reflected Cross-Site Scripting ↗
    2022-07-04 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.5.9 Patched in 5.6.0
33. Medium · 6.1 Booster for WooCommerce <= 5.5.8 - Reflected Cross-Site Scripting ↗
    2022-05-31 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.5.8 Patched in 5.5.9
34. Medium · 6.1 Booster for WooCommerce <= 5.4.8 - Reflected Cross-Site Scripting in Product XML Feeds Module ↗
    2021-12-01 CVE-2021-25001 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 5.4.9 Patched in 5.4.9
35. Medium · 6.1 Booster for WooCommerce <= 5.4.8 - Reflected Cross-Site Scripting in PDF Invoicing Module ↗
    2021-12-01 CVE-2021-24999 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 5.4.9 Patched in 5.4.9
36. Medium · 6.1 Booster for WooCommerce <= 5.4.8 - Reflected Cross-Site Scripting in General Module ↗
    2021-12-01 CVE-2021-25000 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 5.4.9 Patched in 5.4.9
37. Critical · 9.8 Booster for WooCommerce <= 5.4.3 - Authentication Bypass ↗
    2021-08-24 CVE-2021-34646 Authentication Bypass Using an Alternate Path or Channel Affects <= 5.4.3 Patched in 5.4.4
38. Medium · 6.1 Booster for WooCommerce <= 3.7.0 - Cross-Site Scripting ↗
    2018-07-28 CVE-2018-20966 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 3.8.0 Patched in 3.8.0

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

Translated into 55 languages, 1 at 90% or more

Plus 31 more locales with partial translations.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2025-12-03 40K+ → 30K+ down after 369 days in tier
2. 2024-11-29 50K+ → 40K+ down after 328 days in tier
3. 2024-01-06 60K+ → 50K+ down after 286 days in tier
4. 2023-03-26 70K+ → 60K+ down after 1 days in tier
5. 2023-03-25 60K+ → 70K+ up after 1 days in tier
6. 2023-03-24 70K+ → 60K+ down

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• Cart Abandonment Recovery for WooCommerce – Recover Lost Sales with Automated Emails 300K+ installs · 4.8★ · 2 shared tags A
• Google for WooCommerce 800K+ installs · 2.8★ · 1 shared tag B
• WooCommerce PayPal Payments 800K+ installs · 2.9★ · 1 shared tag B
• WooCommerce Stripe Payment Gateway 700K+ installs · 3.1★ · 1 shared tag B
• WooCommerce Tax (formerly WooCommerce Shipping & Tax) 500K+ installs · 2.2★ · 1 shared tag C
• WooCommerce Legacy REST API 400K+ installs · 2.2★ · 1 shared tag D

Embed this report card

Drop a live Pulse card for Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools into a readme, a review or a deck. It updates itself.

Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools: 30K+ active installs, 4.6★ (533 reviews). Plugin Pulse (WP Mayor), as of 2026-08-29. https://plugins.wpmayor.com/plugin/woocommerce-jetpack