Plugin inspection:

WooCommerce – excelling eCommerce

Potentially unsafe

Last revised:

Confidence: Medium
This plugin has been given a short, targeted code review.

Before using this plugin, you should very carefully consider its potential problems and should conduct a thorough assessment. Read more about this recommendation.


The version of this plugin that this recommendation was based on is known to be vulnerable to attack:

This recommendation applies to version 2.1.12 of this plugin, but the most recent version is 9.1.2. These findings may no longer be correct.


  • At over 43,000 lines of PHP this is a very large plugin, which makes it difficult to thoroughly assess
  • Contains an XSS vulnerability:
  • Uses eval() and create_function() (i18n/makepot/extract/extract.php line 203, i18n/makepot/not-gettexted.php lines 73, 78, 111, i18n/makepot/pomo/po.php lines 168, i18n/makepot/pomo/translations.php line 171)
  • In one instance where eval is used (i18n/makepot/extract/extract.php line 203) a comment above says “we can use eval safely, because we are sure $text is just a string literal” This is false, since $text is clearly taken from the output of token_get_all()
  • Values are put into SQL unescaped (includes/abstracts/abstract-wc-product.php line 1191, includes/wc-order-functions.php line 26, etc)

Reason for the 'Potentially unsafe' result

The plugin contains or is likely to contain a vulnerability which could be exploited by an end user and which would compromise the site’s confidentiality, integrity or availability:

  • Contains XSS vulnerability:

Failure criteria

  • Execution of unprepared SQL statements
  • Unsafe generation of PHP code
  • Lack of proper output escaping
  • Very large codebase

Read more about our failure criteria.