Kit (formerly ConvertKit) for WooCommerce
Kit (formerly ConvertKit) for WooCommerce has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2026; all 2 are fixed as of October 2026. Their average CVSS score is 5.3, and the most serious one scores 5.3 out of 10. 2026 was the busiest year with 2 disclosures.
The most common weakness is Exposure Of Sensitive Information To An Unauthorized Actor, behind 1 of the records (50%). Other recurring categories include Missing Authorization.
Every one of the 2 issues recorded for Kit (formerly ConvertKit) for WooCommerce has a vendor fix available, so running the current release closes all known holes.
2 independent researchers contributed these findings, one record each. Kit (formerly ConvertKit) for WooCommerce is installed on roughly 4,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2026-105421Kit (formerly ConvertKit) for WooCommerce <= 2.2.0 - Missing Authorization
Read the full analysisVulnerability Records
Kit (formerly ConvertKit) for WooCommerce
Author
nathanbarry
Kit makes it easy to capture more leads and sell more products by easily embedding email capture forms anywhere. This Plugin integrates WooCommerce with Kit, allowing customers and purchase data to be automatically sent to your Kit account. Full plugin documentation is located here. Configuration Configure the plugin by navigating to WooCommerce > Settings > in the WordPress Administration Menu, then click the Integration tab > Kit Enable the integration Enter your API Key and API Secret, clicking Save changes Choose the Subscription Form, Tag or Sequence to subscribe Customers to when they complete the WooCommerce Checkout Configure other settings as necessary, depending on your requirements (Optional) Configure which Sequence, Form or Tag to subscribe a Customer to when editing individual WooCommerce Products
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C