Meta for WooCommerce

Meta for WooCommerce has 5 disclosed vulnerabilities in the WordSec catalog, reported between 2019 and 2026; all 5 are fixed as of September 2026. Their average CVSS score is 7.0, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 3 high. 2026 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 2 of the records (40%). Other recurring categories include Cross-Site Scripting, Missing Authorization.

Every one of the 5 issues recorded for Meta for WooCommerce has a vendor fix available, so running the current release closes all known holes.

3 independent researchers contributed these findings, one record each. Meta for WooCommerce is installed on roughly 400,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSMedium
7.0/ 10
Patch Coverage100%
Open

0

Fixed

5

Get automatic notifications for all Meta for WooCommerce vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2019-15840

Facebook for WooCommerce <= 1.9.12 - Cross-Site Request Forgery

Read the full analysis

Vulnerability Records

5 records
Plugin Profile
Latestv3.7.6

Meta for WooCommerce

Facebook

Author

Facebook

2.1(479)
42/100
Last Updated
2026-07-23 (2mo ago)
Active Installs
400,000+
Downloads
50,418,171
Requires WP
5.6+
Requires PHP
7.4+
Tested up to
WP 7.0.4
Created
2019-02-22 (8y ago)
Requires Plugins
woocommerce

This is the official Meta for WooCommerce plugin that connects your WooCommerce website to Facebook, Instagram and WhatsApp. With this plugin, you can install the Facebook pixel, upload your online store catalog, enabling you to easily run dynamic ads and connect your WhatsApp Business account to automatically update customers about their orders. Marketing on Meta platforms helps your business build lasting relationships with people, find new customers, and increase sales for your online store. With this Facebook ad extension, reaching the people who matter most to your business is simple. This extension will track the results of your advertising across devices. It will also help you: Maximize your campaign performance. By setting up the Facebook pixel and building your audience, you will optimize your ads for people likely to buy your products, and reach people with relevant ads on Facebook after they’ve visited your website. Find more customers. Connecting your product catalog automatically creates carousel ads that showcase the products you sell and attract more shoppers to your website. Generate sales among your website visitors. When you set up the Facebook pixel and connect your product catalog, you can use dynamic ads to reach shoppers when they’re on Facebook with ads for the products they viewed on your website. This will be included in a future release of Meta for WooCommerce. Engage with customers on WhatsApp by updating your customers about their orders at every step, freeing up more time for you to focus on your business. Support Before raising a question with Meta Support, please first take a look at the Meta helpcenter docs, by searching for keywords like &#8216;WooCommerce’ here. If you didn’t find what you were looking for, you can go to Meta Direct Support and ask your question. When reporting an issue on Meta Direct Support, please give us as many details as possible. * Symptoms of your problem * Screenshot, if possible * Your Facebook page URL * Your website URL * Current version of Facebook-for-WooCommerce, WooCommerce, WordPress, PHP To suggest technical improvements, you can raise an issue on our Github repository. Known limitations Crash recovery uses a shutdown handler to write a disable flag and queue a sanitized crash report. In rare PHP memory-exhaustion fatals, there may be too little memory left for the shutdown handler to run. When that happens, the site still recovers on the next request, but the disable flag and crash report may be skipped for that request.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C