Back In Stock Notifier for WooCommerce | WooCommerce Waitlist Pro
Back In Stock Notifier for WooCommerce | WooCommerce Waitlist Pro has one disclosed vulnerability in the WordSec catalog, all reported in 2024; it is fixed as of October 2026. Their average CVSS score is 6.5, and the most serious one scores 6.5 out of 10.
The most common weakness is Code Injection, behind 1 of the records (100%).
The one issue recorded for Back In Stock Notifier for WooCommerce | WooCommerce Waitlist Pro has a vendor fix available, so running the current release closes it.
All of these findings were reported by stealthcopter. Back In Stock Notifier for WooCommerce | WooCommerce Waitlist Pro is installed on roughly 20,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2024-4038Back In Stock Notifier for WooCommerce | WooCommerce Waitlist Pro <= 5.3.1 - Unauthenticated Arbitrary Shortcode Execution
Read the full analysisVulnerability Records

Back In Stock Notifier for WooCommerce | WooCommerce Waitlist Pro
Author
ProPluginsLab
woocommerceEvery out-of-stock product is a lost sale waiting to happen. Back In Stock Notifier for WooCommerce captures those visitors instead of losing them. It shows an email subscription form on out-of-stock products, then automatically emails every subscriber the moment the product is restocked. Try the Live Demo | Documentation | Support | Browse Add-ons Why store owners choose this plugin Built for scale. Restock emails are sent through a background process engine. Even with 10,000+ subscribers on a single product, notifications go out reliably. No server crashes, no timeouts, no duplicate emails that loop-based plugins suffer from. Works out of the box. Activate the plugin and the waitlist form appears on out-of-stock products immediately. No setup required. Native WooCommerce emails. The subscription confirmation and restock notification emails use the WooCommerce email system, so they match your store branding and are fully customizable under WooCommerce > Settings > Emails. Trusted by 20,000+ stores worldwide. Supported product types Simple and Variable products (product level and variation level) Grouped products Simple and Variable Subscriptions (WooCommerce Subscriptions) Product Bundles (WooCommerce Product Bundles) Core features Automatic restock emails sent through a reliable background process Email subscription form on out-of-stock products, for both guests and members Email address pre-filled for logged-in members Duplicate check per product, the same email is never added twice to a waitlist Customizable subject and message with placeholders like {product_name}, {product_link}, {cart_link} and more Customizable form labels, messages, and error texts Option to show the subscribe form for backorder products Fair Sending (First-Come-First-Served), on a limited restock notify only as many subscribers as units in stock, the rest stay on the waitlist for the next restock Email speed limit, send automatic emails gradually to respect hosting and SMTP provider limits Six subscribe form designs (Default, Card, Minimal, Compact, Bold, Outline) and six popup designs including five lightweight popups that need no extra library, all chosen from the settings page Auto Coupon, optionally send each subscriber a unique discount code that only works on the exact product or variation they waited for, with full control over discount type, amount, expiry, usage limit, minimum spend and sale item rules Product table placeholder for both emails, showing the subscribed product in a classic order style table with thumbnail, SKU, quantity and price Stock status filter on the subscribers list, including “in stock but below your notification threshold” to find subscribers the automatic sender skipped Auto-retry for stuck emails, an optional recovery task that resends notifications when a background job fails or never runs New subscriber indicator on the admin menu and subscribers list, showing how many people signed up since your last visit Bot protection with Google reCAPTCHA (v2/v3) and Cloudflare Turnstile Subscriber management dashboard to view, sort, filter, and delete subscribers Manual and bulk send instock mail actions Dashboard report widget with subscription and mail statistics Estimate Stock Arrival messages on the subscribe form Auto-delete old subscriber entries on a schedule GDPR-friendly privacy checkbox Third-party inventory management support (stock updated directly in the database) REST API to create, read, update, and delete subscribers Webhooks for subscription events Quantity field support Works with Elementor Translation ready Add-ons Supercharge your waitlist with premium add-ons. Every purchase is a one-time payment with lifetime updates. No subscriptions, no recurring fees. You can browse and manage everything from your dashboard under Instock Notifier > Plugins & Add-ons. Best value: get Bundle Add-ons, all 26 add-ons in one plugin with one licence key, plus every future add-on, for one discounted price. Switch each add-on on or off individually. Subscriber experience Double Opt-In – Subscribers confirm by email before joining the waitlist. Keeps your list clean and compliant, and unconfirmed entries are auto-deleted after X days. Unsubscribe – Adds an unsubscribe link to emails, and members can manage their waitlists from My Account. Demand Signals – Show how many people are already waiting for an out of stock product, and where a new subscriber sits in the queue. Priority – Decide who hears first when stock is limited by ordering the queue by signup time, spend, or customer role. Reminders – Follow up with people who were told a product is back but have not bought it yet, while it is still in stock. Never Restock – Product discontinued? Point waiting subscribers to an alternative product and notify them when it becomes available, so no waitlist goes to waste. Twilio SMS – Send restock alerts by SMS in addition to email, so customers never miss a restock. Custom CSS – Style the subscribe form with color, size, and custom CSS options. No coding needed. Email marketing integrations Klaviyo – Sync subscribers to Klaviyo and trigger Klaviyo Flows for Back In Stock and Successful Subscription events, so you can build advanced automations and campaigns. Mailchimp – Automatically sync waitlist subscribers to your Mailchimp audience in the background. Brevo – Sync waitlist subscribers into a Brevo list with product attributes, and optionally send a Brevo transactional template as the restock notification. Omnisend – Sync waitlist subscribers into Omnisend as tagged contacts and fire a custom event on signup and restock. MailerLite – Sync waitlist subscribers into a MailerLite group, with the product they are waiting for saved in custom fields for automations. Constant Contact – Sync waitlist subscribers into a Constant Contact list over OAuth, with tokens refreshed automatically and the product they are waiting for recorded. ActiveCampaign – Sync subscribers to ActiveCampaign automatically. Multilingual WPML – Send every email in the subscriber’s own language using WPML string translation. Polylang – Send subscription and restock emails in the subscriber’s chosen Polylang language. Weglot – Remembers the language each person was browsing in when they subscribed, and sends their restock notification in that language. TranslatePress – Remembers the language each person was browsing in when they subscribed, so their emails arrive in that language. Insights and team Analytics – Turn the waitlist into a buying signal: demand ranked by product, conversion and revenue per restock, notification outcomes, and signup trends. Track Sales – See which subscribers purchased after receiving a restock email and measure the revenue your waitlist recovers. Team Alerts – Push waitlist signals to Slack, Discord, Microsoft Teams or any webhook, with demand threshold alerts and restock summaries. Subscriber management Ban Emails – Block disposable email domains (mailinator and similar), public domains, and specific addresses to stop fake signups. Edit Subscribers – Correct or update existing subscriber entries directly from the admin. Import CSV – Import subscribers from a CSV file when migrating from another platform or store. Export CSV – Export subscriber lists to CSV for records, newsletters, or promotions. See the full catalog at propluginslab.io, with more add-ons coming soon. More plugins from ProPluginsLab Free on WordPress.org: Recovero – Cart Recovery for WooCommerce – Recover abandoned carts with automated emails. Anticipo – Pre-Orders for WooCommerce – Take pre-orders before a product launches. Affireo – Affiliates for WooCommerce – Run an affiliate and referral program. Storefold – Multivendor Marketplace for WooCommerce – Turn your store into a multivendor marketplace. Dispatchio – Shipment Tracking for WooCommerce – Add tracking numbers and shipment updates to orders. Presentero – Gift Cards for WooCommerce – Sell and redeem digital gift cards. Kitero – Product Configurator for WooCommerce – Build composite products and kits. Plusero – Extra Fees for WooCommerce – Add conditional checkout fees and surcharges. Inputo – Name Your Price for WooCommerce – Let customers choose what they pay. Mercenza – B2B for WooCommerce – Sell wholesale with customer groups, wholesale prices and trade accounts. Visuaro – Product Designer for WooCommerce – Let customers design custom products in the browser. Christmas Snow – Festive Snowfall Effect – Add a lightweight snowfall effect to any site. Pro plugins at propluginslab.io: Recovero Pro Anticipo Pro Affireo Pro Storefold Pro Dispatchio Pro Presentero Pro Kitero Pro Plusero Pro Inputo Pro Mercenza Pro Visuaro Pro External services The plugin works without any external service. The services below are used only when you turn them on. Google reCAPTCHA (off by default; Instock Notifier > Settings > Bot Protection). Protects the subscribe form from bots. When turned on, the reCAPTCHA script is loaded from google.com on pages that show the form, and the visitor’s reCAPTCHA token is sent to https://www.google.com/recaptcha/api/siteverify with your secret key when the form is submitted. Google may collect data about the visitor’s browser and device. Terms of Service, Privacy Policy. Cloudflare Turnstile (off by default; Instock Notifier > Settings > Bot Protection). Protects the subscribe form from bots. When turned on, the Turnstile script is loaded from challenges.cloudflare.com on pages that show the form, and the visitor’s Turnstile token is sent to https://challenges.cloudflare.com/turnstile/v0/siteverify with your secret key when the form is submitted. Terms of Use, Privacy Policy. ProPluginsLab catalogue (propluginslab.io, run by the plugin author). The Plugins & Add-ons admin page lists the available add-ons and plugins. The list is downloaded from https://propluginslab.io/wp-json/cwg-feed/v1/products and https://propluginslab.io/wp-json/cwg-feed/v1/promotion only when an administrator presses Refresh on that page, or once a day if “Refresh the Plugins & Add-ons catalogue daily” is turned on (off by default) under Instock Notifier > Settings > Troubleshoot Settings. It is a plain request: no data about your store, its customers or its subscribers is sent. Terms and Conditions, Privacy Policy. WooCommerce webhooks: the plugin adds subscriber topics to WooCommerce webhooks (WooCommerce > Settings > Advanced > Webhooks). If you create a webhook with one of these topics, subscriber details are sent to the delivery URL you choose. Nothing is sent unless you create one.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C