Checkout Files Upload for WooCommerce
Checkout Files Upload for WooCommerce has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2026; all 4 are fixed as of September 2026. Their average CVSS score is 6.3, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high. 2025 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Scripting, behind 3 of the records (75%). Other recurring categories include Authorization Bypass Through User-Controlled Key.
Every one of the 4 issues recorded for Checkout Files Upload for WooCommerce has a vendor fix available, so running the current release closes all known holes.
4 independent researchers contributed these findings, one record each. Checkout Files Upload for WooCommerce is installed on roughly 7,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2025-4212Checkout Files Upload for WooCommerce <= 2.2.1 - Unauthenticated Stored Cross-Site Scripting
Read the full analysisVulnerability Records

Checkout Files Upload for WooCommerce
Author
WP Wham
Checkout Files Upload for WooCommerce plugin lets your customers upload files on (or after) WooCommerce checkout. Features Set field’s position on WooCommerce checkout page: Before checkout form. After checkout form. Do not add on checkout. Set if file upload is required. If you need files to be uploaded after order is created, you can optionally add field to: WooCommerce Thank You (i.e. Order Received) page. WooCommerce My Account page. Add custom label to the field. Set accepted file types. Set custom Upload and Remove button labels. Set custom messages: “Wrong file type”. “Wrong image dimensions” and “Couldn’t get image dimensions”. “File is required”. “File was successfully uploaded”. “No file selected”. “File was successfully removed”. Optionally set field to show up only if in cart there are selected: Products. Product categories. Product tags. Add uploaded files to admin and customers emails. Send additional emails if user uploads or removes files on “Thank You” or “My Account” pages. Customize the frontend files upload form. Optionally enable AJAX form for file uploads. Set max file size option. Optionally validate image dimensions. Feedback We are open to your suggestions and feedback. Thank you for using or trying out one of our plugins! Drop us a line at www.wpwham.com. More Visit the Checkout Files Upload for WooCommerce plugin page.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C