Saphali Woocommerce Lite

Saphali Woocommerce Lite has one disclosed vulnerability in the WordSec catalog, all reported in 2023; it is fixed as of September 2026. Their average CVSS score is 5.4, and the most serious one scores 5.4 out of 10.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (100%).

The one issue recorded for Saphali Woocommerce Lite has a vendor fix available, so running the current release closes it.

All of these findings were reported by Kévin Mosbahi (Mika). Saphali Woocommerce Lite is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium
5.4/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all Saphali Woocommerce Lite vulnerabilities before they are exploited.

Highest severity on recordCVSS 5.4CVE-2023-25788

Saphali Woocommerce Lite <= 1.8.13 - Cross-Site Request Forgery via 'woocommerce_saphali_page_s_l'

Read the full analysis

Vulnerability Records

1 records
Saphali Woocommerce Lite banner
Latestv2.0.2

Saphali Woocommerce Lite

Saphali

Author

Saphali

4.2(25)
84/100
Last Updated
2026-09-08 (5d ago)
Active Installs
10,000+
Downloads
553,689
Requires WP
4.5+
Requires PHP
0+
Tested up to
WP 7.1
Created
2012-10-21 (14y ago)

WooCommerce Lite! Functional additions for WooCommerce – specifically for managing fields on the checkout page. Integrates into the store: Ability to customize the order form for checkout Manage the number of columns in the catalog Features From WooCommerce version 8.3, fields are used as blocks by default (i.e., fields are configured as if editing the Checkout page itself). The plugin has been tested for compatibility with Checkout Blocks from WooCommerce 8.5.0 and above. If you have a lower version and the functionality in the block checkout does not work, to use the capabilities of this plugin, you just need to switch to Classic Shortcode when editing the Checkout page. If necessary, you can always convert back to blocks. Added to the general list of currencies — Ukrainian Hryvnia (UAH), Russian Ruble (RUB), Belarusian Ruble (BYN), Armenian Dram (AMD), Kyrgyz Som (KGS), Kazakhstani Tenge (KZT), Uzbekistani Som (UZS), Lithuanian Litas (LTL) Manage fields on the checkout page and profile page. The function allows you to customize the order form for checkout. You can make some fields optional at checkout or remove them completely, thereby simplifying the checkout process. You can also add your own special fields. Manage the number of columns in the product catalog (Shop) and categories. The plugin is designed to simplify the development of online stores. The plugin does not change the original WooCommerce files, you can update the WooCommerce plugin every time new versions are released! Mapping fields to payment and shipping methods, e.g., it will be useful if some fields do not need to be displayed when paying with a certain shipping and/or payment method, but are needed with another shipping or payment method. ATTENTION! More about payment gateway plugins: https://saphali.com/wordpress/payment-gateways , https://saphali.com/en/wordpress/payment-gateways See other plugins for WooCommerce online stores in our catalog https://saphali.com/wordpress/woocommerce-plugins License This plugin is free for everyone as it is released under the GPL. You can use it for free in your online stores. But if you like this plugin, you can thank us by sharing the link to our website with your friends and colleagues. Translations We assume that the Russian localization for WooCommerce can be further improved. If you notice an incorrect translation in the WooCommerce settings or it can be replaced with an alternative and more suitable one, here – https://translate.wordpress.org/projects/wp-plugins/woocommerce/stable/ru/default Demo You can check this plugin in action on our website http://saphali.com/ – on the “Demo Online Store” page.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C