Plugin security history

Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 38 vulnerability records associated with Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools, published between 2018 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

38Total records

1Critical

10High

27Medium

0Low

0Informational

38Patched records

0Currently marked unpatched

2018-07-28First disclosure

2026-06-23Latest disclosure

32 of 38CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2018	1	1 records
2021	4	4 records
2022	10	10 records
2023	8	8 records
2024	6	6 records
2025	7	7 records
2026	2	2 records

Severity Breakdown

Severity	Records	Share
Critical	1	2.6%
High	10	26.3%
Medium	27	71.1%

Vulnerability-Type Breakdown

Cross-Site Scripting

17 records44.7%

First: 2018. Latest: 2025.

CSRF

6 records15.8%

First: 2022. Latest: 2023.

Missing Authorization

6 records15.8%

First: 2022. Latest: 2026.

Arbitrary File Upload

4 records10.5%

First: 2025. Latest: 2026.

Information Disclosure

2 records5.3%

First: 2023. Latest: 2023.

Authentication Bypass

1 record2.6%

First: 2021. Latest: 2021.

Path Traversal

1 record2.6%

First: 2022. Latest: 2022.

Other

1 record2.6%

First: 2024. Latest: 2024.

Patch Status

Patched: 38
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

8.0.2
7.11.3
7.5.0
7.4.0
7.2.6
7.2.5
7.2.4
7.1.9
7.1.8
7.1.7
7.1.3
7.1.2
7.1.1
7.1.0
6.0.1
6.0.0
5.6.7
5.6.3
5.6.2
5.6.0
5.5.9
5.4.9
5.4.4
3.8.0

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-8.0.1`	Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools <= 8.0.1 - Authenticated (Customer+) Arbitrary File Upload	June 23, 2026	8.0.2	High
`[*, 7.11.3)`	Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools < 7.11.3 - Missing Authorization	March 17, 2026	7.11.3	Medium
`*-7.4.0`	Booster for WooCommerce <= 7.4.0 - Missing Authorization	October 30, 2025	7.5.0	Medium
`*-7.3.2`	Booster for WooCommerce <= 7.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	October 18, 2025	7.4.0	Medium
`*-7.2.4`	Booster for WooCommerce <= 7.2.4 - Unauthenticated Double Extension Arbitrary File Upload	August 28, 2025	7.2.5	High
`*-7.2.5`	Booster for WooCommerce <= 7.2.5 - Reflected Cross-Site Scripting	April 22, 2025	7.2.6	Medium
`4.0.1-7.2.4`	Booster for WooCommerce 4.0.1 - 7.2.4 - Unauthenticated Stored Cross-Site Scripting	April 3, 2025	7.2.5	High
`4.0.1-7.2.4`	Booster for WooCommerce 4.0.1 - 7.2.4 - Unauthenticated Arbitrary File Upload	April 3, 2025	7.2.5	High
`*-7.2.4`	Booster for WooCommerce <= 7.2.4 - Unauthenticated Stored Cross-Site Scripting	March 31, 2025	7.2.5	High
`*-7.2.3`	Booster for WooCommerce <= 7.2.3 - Authenticated (ShopManager+) Stored Cross-Site Scripting via wcj_product_meta Shortcode	November 25, 2024	7.2.4	Medium
`*-7.2.3`	Booster for WooCommerce <= 7.2.3 - Reflected Cross-Site Scripting	November 19, 2024	7.2.4	Medium
`*-7.1.8`	Booster for WooCommerce <= 7.1.8 - Unauthenticated Arbitrary Shortcode Execution	May 1, 2024	7.1.9	Medium
`*-7.1.7`	Booster for WooCommerce <= 7.1.7 - Reflected Cross-Site Scripting	March 25, 2024	7.1.8	Medium
`*-7.1.7`	Booster for WooCommerce <= 7.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortocde	March 6, 2024	7.1.8	Medium
`*-7.1.6`	Booster for WooCommerce <= 7.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting	February 12, 2024	7.1.7	Medium
`*-7.1.1`	Booster for WooCommerce <= 7.1.1 - Missing Authorization to Authenticated (Subscriber+) Order Information Disclosure	November 24, 2023	7.1.2	Medium
`*-7.1.2`	Booster for WooCommerce <= 7.1.2 - Missing Authorization to Product Creation/Modification	November 24, 2023	7.1.3	Medium
`*-7.1.2`	Booster for WooCommerce <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	October 18, 2023	7.1.3	Medium
`*-7.1.1`	Booster for WooCommerce <= 7.1.1 - Authenticated (Subscriber+) Information Disclosure via Shortcode	October 4, 2023	7.1.2	Medium
`*-7.1.0`	Booster for WooCommerce <= 7.1.0 - Authenticated (Subscriber+) Information Disclosure via Shortcode	September 13, 2023	7.1.1	Medium
`*-7.1.0`	Booster for WooCommerce <= 7.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	September 13, 2023	7.1.1	Medium
`7.0.0`	Booster for WooCommerce 7.0.0 - Authenticated (Shop Manager+) Missing Authorization to Arbitrary Options Update	August 1, 2023	7.1.0	High
`*-6.0.0`	Booster (<= 6.0.0), Booster Plus (<= 6.0.0), and Booster Elite (<= 6.0.0) for WooCommerce - Cross-Site Request Forgery	January 2, 2023	6.0.1	Medium
`*-5.6.2`	Booster (<= 5.6.2), Booster Plus (< 6.0.0), and Booster Elite (< 6.0.0) for WooCommerce - Reflected Cross-Site Scripting	December 5, 2022	5.6.3	Medium
`*-5.6.8`	Booster for WooCommerce <= 5.6.8 - Cross-Site Request Forgery	November 30, 2022	6.0.0	High

Selected source records

Latest Records

HighCVE-2026-56027

Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools <= 8.0.1 - Authenticated (Customer+) Arbitrary File Upload

Published: June 23, 2026

Affected versions: *-8.0.1
Patched versions: 8.0.2

Original Wordfence record

MediumCVE-2026-32586

Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools < 7.11.3 - Missing Authorization

Published: March 17, 2026

Affected versions: [*, 7.11.3)
Patched versions: 7.11.3

Original Wordfence record

MediumCVE-2025-64379

Booster for WooCommerce <= 7.4.0 - Missing Authorization

Published: October 30, 2025

Affected versions: *-7.4.0
Patched versions: 7.5.0

Original Wordfence record

MediumCVE-2025-64380

Booster for WooCommerce <= 7.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: October 18, 2025

Affected versions: *-7.3.2
Patched versions: 7.4.0

Original Wordfence record

HighCVE-2024-13342

Booster for WooCommerce <= 7.2.4 - Unauthenticated Double Extension Arbitrary File Upload

Published: August 28, 2025

Affected versions: *-7.2.4
Patched versions: 7.2.5

Original Wordfence record

MediumCVE-2025-64196

Booster for WooCommerce <= 7.2.5 - Reflected Cross-Site Scripting

Published: April 22, 2025

Affected versions: *-7.2.5
Patched versions: 7.2.6

Original Wordfence record

HighCVE-2024-13708

Booster for WooCommerce 4.0.1 - 7.2.4 - Unauthenticated Stored Cross-Site Scripting

Published: April 3, 2025

Affected versions: 4.0.1-7.2.4
Patched versions: 7.2.5

Original Wordfence record

HighCVE-2024-13744

Booster for WooCommerce 4.0.1 - 7.2.4 - Unauthenticated Arbitrary File Upload

Published: April 3, 2025

Affected versions: 4.0.1-7.2.4
Patched versions: 7.2.5

Original Wordfence record

Highest-Severity Records

CriticalCVE-2021-34646

Booster for WooCommerce <= 5.4.3 - Authentication Bypass

Published: August 24, 2021

Affected versions: *-5.4.3
Patched versions: 5.4.4

Original Wordfence record

HighCVE-2022-41805

Booster for WooCommerce <= 5.6.6 - Cross-Site Request Forgery

Published: October 27, 2022

Affected versions: *-5.6.6
Patched versions: 5.6.7

Original Wordfence record

High

Booster for WooCommerce <= 5.6.1 - Cross-Site Request Forgery

Published: July 27, 2022

Affected versions: *-5.6.1
Patched versions: 5.6.2

Original Wordfence record

HighCVE-2022-3763

Booster for WooCommerce (Free <= 5.6.6, Premium <= 5.6.4) - Cross-Site Request Forgery to File Deletion

Published: October 31, 2022

Affected versions: *-5.6.4
Patched versions: 5.6.5

Affected versions: *-5.6.6
Patched versions: 5.6.7

Original Wordfence record

HighCVE-2026-56027

Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools <= 8.0.1 - Authenticated (Customer+) Arbitrary File Upload

Published: June 23, 2026

Affected versions: *-8.0.1
Patched versions: 8.0.2

Original Wordfence record

High

Booster for WooCommerce <= 5.6.8 - Cross-Site Request Forgery

Published: November 30, 2022

Affected versions: *-5.6.8
Patched versions: 6.0.0

Original Wordfence record

HighCVE-2024-13342

Booster for WooCommerce <= 7.2.4 - Unauthenticated Double Extension Arbitrary File Upload

Published: August 28, 2025

Affected versions: *-7.2.4
Patched versions: 7.2.5

Original Wordfence record

HighCVE-2024-13744

Booster for WooCommerce 4.0.1 - 7.2.4 - Unauthenticated Arbitrary File Upload

Published: April 3, 2025

Affected versions: 4.0.1-7.2.4
Patched versions: 7.2.5

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory