ProveSource Social Proof
ProveSource Social Proof has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of October 2026. Their average CVSS score is 5.3, and the most serious one scores 5.3 out of 10.
The most common weakness is Exposure Of Sensitive Information To An Unauthorized Actor, behind 1 of the records (100%).
The one issue recorded for ProveSource Social Proof has a vendor fix available, so running the current release closes it.
All of these findings were reported by Bao - BlueRock. ProveSource Social Proof is installed on roughly 2,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2025-48355ProveSource Social Proof <= 3.1.2 - Unauthenticated Sensitive Information Disclosure
Read the full analysisVulnerability Records

ProveSource Social Proof
Author
ProveSource
ProveSource is a social proof tool and FOMO app that boosts conversions on your WordPress and WooCommerce website. Ever booked a hotel because it was selling fast and you did not want to miss out? Ever gone to a restaurant because a friend recommended it? That is social proof. Consumers trust what other people do more than advertising when they make buying decisions. Consumers who experience FOMO (fear of missing out) are more likely to buy sooner. Showing sales notifications and positive reviews has been shown to increase conversions by up to 17%. ProveSource connects to your WordPress website and WooCommerce store and imports your recent orders, so sales notifications start showing right away. It shows recent orders, product reviews, page visits and live visitor counts, and each sales notification links to the purchased product for upsell and cross-sell opportunities. Feature highlights Sales notifications that show recent orders to create urgency. Review notifications that show your real 5 star WooCommerce product reviews. Only real orders and reviews are shown, which builds trust. Customize the position, timing, colors, images and the pages each notification shows on. Optimized for mobile, shown at the top or bottom of the screen. Clickable notifications that take visitors to the advertised product. Translated into more than 22 languages. A subtle nudge style that fits your brand instead of an obtrusive popup. Integrations ProveSource integrates with 100+ services including WooCommerce, Zapier, Mailchimp, Elementor, Google Reviews, Capterra and Judge.me. See the full list of integrations. ProveSource also builds and maintains Shapo, a platform to collect, manage and display reviews and testimonials with forms, widgets, a wall of love and email campaigns. Support Our support team is available by live chat and email. Pricing ProveSource is a subscription service with a free plan. Manage your subscription in the ProveSource dashboard (click the logo on the plugin settings page). External services This plugin relies on ProveSource, a service operated by Configo LTD. The plugin sends nothing until you click “Connect to ProveSource” or save an API key. Terms of service, privacy policy. Notification script. The plugin adds a script to every page of your site that loads https://cdn.provesrc.com/provesrc.js. The script shows the notifications, keeps a visitor identifier in a cookie and in local storage, records page visits and, for forms you choose to track in the ProveSource dashboard, the submitted form fields (for example a name and email). It sends this data to api.provesrc.com. Connect. The “Connect to ProveSource” button opens console.provesrc.com with your site URL. After you approve the site, the plugin trades a one-time code with api.provesrc.com for your API key and webhook secret. Setup. When you connect or save the settings, the plugin sends your site name, description and URL and the selected order events. When you connect to an account for the first time or switch to another one, and when you click “Re-import Last 30 Orders”, it also sends your last 30 orders (the order data listed below), skipping unpaid, failed, cancelled and refunded orders. Orders. For each new WooCommerce order the plugin sends, in the background: the order ID, date, total and currency, the customer’s first name, last name and email (the email is used for the customer’s Gravatar image), the billing or shipping city, state and country, and the products (ID, name, price, quantity, link and image). The customer IP address is sent only when an order has no city or country, so the location can be looked up. Street addresses, phone numbers and postcodes are never sent. Failed, cancelled and refunded orders are not sent. Reviews. Your latest 100 approved WooCommerce product reviews are sent when you connect, when you save the settings and when you click “Import Reviews”, and a review is sent again whenever it is approved, edited, unapproved, marked as spam or deleted. A review is sent as the author’s display name, the rating, text and date, whether the author is a verified owner, and the product ID, name, link and image. Reviewer emails and IP addresses are never sent. Error reports. When the plugin hits an error it sends the error message, a short stack trace, your site URL, the plugin, WordPress, WooCommerce and PHP versions and the order ID. No order or customer data is included. Uninstall. When the plugin is deleted it sends your site URL so the site is removed from your ProveSource account.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C