FriendStore for WooCommerce
FriendStore for WooCommerce has one disclosed vulnerability in the WordSec catalog, all reported in 2024; it is fixed as of October 2026. Their average CVSS score is 6.1, and the most serious one scores 6.1 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for FriendStore for WooCommerce has a vendor fix available, so running the current release closes it.
All of these findings were reported by João Pedro Soares de Alcântara. FriendStore for WooCommerce is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.4.
CVE-2024-51784FriendStore for WooCommerce <= 1.4.2 - Reflected Cross-Site Scripting
Read the full analysisVulnerability Records

FriendStore for WooCommerce
Author
VietFriend team
MAIN FEATURES 1. Customize WooCommerce address fields Customize WooCommerce address fields everywhere: ▪ Back-end: Store address ▪ Back-end: Your profile ▪ Back-end: Order details ▪ Front-end: Cart page ▪ Front-end: Checkout page ▪ Front-end: My account > Adresses … 2. Vietnam’s new 2-tier administrative units (merger of 01/07/2025) Both address models are supported side by side: the old 3-tier one (Province / District / Ward) and the new 2-tier one (Province / Ward, 34 provinces). Already-saved addresses always keep the units they were entered with — the setting only governs how new addresses are entered. ▪ Switch new addresses to the 2-tier units (add to your theme’s functions.php): add_filter('fsw_use_v2025_address', '__return_true'); ▪ (Pro) Or simply pick the model on FriendStore → Addons Settings → “Administrative units” ▪ Saved old addresses convert automatically when a form opens: the province follows the official 63 → 34 merger exactly, and the ward is pre-picked when its name (or its old district’s name) carried over — checkout, My account and the store address all prefill this way, and nothing is rewritten until the form is saved ▪ Admin screens keep both catalogues side by side (old provinces marked “(cũ)”), so existing orders and customer profiles keep displaying exactly what was entered ▪ (Pro) ViettelPost quotes the new units live; a delivery unit that cannot quote them through its API yet stays choosable at checkout as “Calculate fee later” 3. Add new order statuses ▪ Shipping (wc-shipping) ▪ Shipped (wc-shipped) 4. Address book (like tiki, sendo, lazada, shopee…) ▪ Disable address book: add_filter('fsw_user_addresses_enabled', '__return_false'); 5. Calculate shipping fee on product detail (like tiki, sendo, lazada, shopee…) ▪ Disable calculate shipping: add_filter('fsw_product_shipping_calculator_enabled', '__return_false'); ▪ Turn off auto calculate shipping: add_filter('fsw_product_shipping_calculator_auto', '__return_false'); 6. Freeship coupons Two coupon types that discount the shipping fee instead of the cart items: ▪ “Shipping discount” — a fixed amount off each rate (empty/0 = completely free) ▪ “Shipping discount (%)” — a percentage off, with an optional “Max discount” cap ▪ The cart/checkout shows the original fee struck through next to the price to pay, and the coupon row shows the real shipping discount ▪ Acts on every paid shipping method; (Pro) acts on the delivery units’ live rates instead, zone methods keep their price 7. Integrating with delivery units (Pro) ▪ Giao hàng nhanh (GHN express): live rates + delivery time estimate, create order, tracking, cancel ▪ Giao hàng tiết kiệm (GHTK express): live rates (fly/road), create order, tracking, cancel ▪ Viettel Post: shipping rates — including the new 2-tier units ▪ Enable/disable each unit on its own card (Delivery Units tab) 8. Stores — sender locations (Pro) ▪ Manage pickup/sender branches and pick a default store for quotes & waybills ▪ Link/sync a store with the carrier’s shop list (GHN, GHTK) ▪ Shortcodes: stores map [fsw_store_maps] and store details [fsw_store_details] 9. Waybill management (Pro) Manage shipments as first-class records on their own “Waybills” admin page: ▪ Create waybills from an order (one click from the order screen) or standalone ▪ Draft → send to carrier → automatic status tracking (GHN, GHTK, every 30 minutes) ▪ Cancel at the carrier and resubmit with another delivery unit ▪ Self-delivery and WooCommerce Shipping as manual delivery choices ▪ Printable shipping labels (A5 / A6 / 10×15) with barcode + QR, designed in the Customizer ▪ Recipient changes on a waybill sync back to the order, with an order note ▪ Optional: the order moves to Shipping / Shipped along with its waybill ▪ Public tracking shortcode for customers: [fsw_tracking unit=”ghn|ghtk|spx”] EXTENSION DEVELOPMENT PLAN ▪ Carrier fee quoting & waybills for the new 2-tier units (as soon as the carriers’ APIs support them) ▪ Waybill CSV import/export USEFUL LINKS: ▪ Website (Pro version): //store.vietfriend.info (Account: demo/123456) ▪ Product information: //code.vietfriend.info/product/friendstore-for-woocommerce-pro/ Translations included ▪ English (US) (English (US)) ▪ Tiếng Việt (Vietnamese)
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C