StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More
StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2025 and 2026; all 3 are fixed as of October 2026. Their average CVSS score is 7.3, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high. 2025 was the busiest year with 2 disclosures.
The most common weakness is Path Traversal, behind 2 of the records (67%). Other recurring categories include Unrestricted Upload Of File With Dangerous Type.
Every one of the 3 issues recorded for StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More has a vendor fix available, so running the current release closes all known holes.
2 independent researchers contributed these findings, most of them (2) reported by Ryan Kozak. StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More is installed on roughly 600 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2025-9216StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More <= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Upload
Read the full analysisVulnerability Records

StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More
Author
Kodezen LLC
StoreEngine — The Complete WordPress eCommerce Plugin to Build, Sell, and Run Your Entire Store StoreEngine is a complete WordPress ecommerce plugin and store management platform — a fast, modern, lightweight market leader alternative that lets you sell digital products, physical products, subscriptions, memberships, courses, services, and licenses from a single Gutenberg-native core. But StoreEngine is no longer just an online store plugin. It now runs your entire commerce operation: a built-in POS terminal, inventory and multi-location stock control, suppliers and purchase orders, cost and profit tracking, returns (RMA), courier management, and a full multi-vendor marketplace — all without stacking 5+ premium plugins or paying for add-ons. Whether you sell online, in person, or both, StoreEngine gives you everything to start, manage, and scale your store inside WordPress — securely, smoothly, and without slowing your site down. Check our overview video of StoreEngine 👇 StoreEngine | Docs | Video Tutorials | Community | Public Roadmap 🎯 Built for store owners who want everything in one place Agencies & freelancers — ship a complete store for any client without stacking plugins Digital creators — sell ebooks, software, templates, and assets with secure file delivery and license keys Physical & retail sellers — manage inventory, POS, shipping, suppliers, and returns from one dashboard Subscription & membership businesses — recurring billing, trials, upgrades, and gated access, natively Course creators — sell online courses through native Academy LMS integration Service providers — sell packages, appointments, and one-time services with flexible checkout Marketplace builders — launch a multi-vendor store with vendor dashboards and commissions 🛒 Sell Anything — Digital, Physical, Subscriptions & More StoreEngine handles every product type from one ecommerce dashboard — no separate plugins, no extra add-on costs. Sell digital products — secure, signed download URLs with instant delivery for software, ebooks, music, and design assets Physical product selling — SKU tracking, variants (size, color, material), and stock status built in Subscription products — flexible billing cycles with trials, upgrades, downgrades, and cancellations Memberships & access control — gate content, courses, and communities with one-time or recurring access Sell online courses — native Academy LMS integration for course checkout, enrollments, and bundles License management — automate license creation, activation, renewals, and usage tracking Product bundles — group products, courses, or memberships into a single high-value offer Installment plans — let customers pay high-ticket items in scheduled payments to reduce hesitation Catalog mode — display products without checkout, perfect for wholesalers and previews 🏬 Run Your Whole Store — POS, Inventory & Operations This is where StoreEngine goes beyond a typical WordPress ecommerce plugin into a full retail and store management system. POS terminal — fast in-person checkout with online/offline inventory sync; sell in-store and online from one system Inventory management — stock tracking, quantity adjustments, low-stock alerts, and movement monitoring Multi-location inventory — manage stock across warehouses and stores with transfers and availability tracking Suppliers & purchase orders — create POs, track incoming stock, and streamline restocking Cost & profit tracking — monitor product costs, margins, and store profitability for smarter pricing Return / RMA system — structured returns, refund requests, and approval workflows Couriers management — manage delivery couriers, fulfillment, and order tracking centrally Shipping module — multiple zones, flat-rate pricing, and real-time carrier integrations SKU & barcode generator — auto-generate SKUs and barcode labels with logo and store-name toggles 💳 Payments & Checkout That Convert Stripe & PayPal out of the box — PCI-DSS compliant card payments, refunds, and subscription billing Razorpay — accept UPI, net banking, wallets, and cards across India Native Stripe subscriptions — webhook-driven renewals with “Pay Next Renewal Now” support Subscriptions + one-time products in the same cart — single checkout, no separate orders Installment & free (zero-total) checkout — flexible payment flows and frictionless giveaways Order pay — recover failed or pending orders without creating a new one Direct checkout URLs — pre-applied products and coupons for funnels and campaigns Multi-currency support — let customers browse and pay in their preferred currency StoreEngine invoice — auto-generate professional invoices customers can download instantly 📈 Built-in Growth & Marketing Tools Most plugins charge extra for the features that actually grow revenue. StoreEngine includes them natively. Upsell & cross-sell — boost average order value with related offers and post-purchase add-ons Built-in affiliate system — track referrals, manage commissions, and turn customers into promoters Coupons & discounts — flat or percentage offers with expiry dates and usage limits Advanced analytics dashboard — revenue trends, product performance, and conversion data in one place 🤝 Launch a Multi-Vendor Marketplace Turn your store into a multi-vendor marketplace where vendors register, manage their own products, and sell from a dedicated dashboard — with commission tracking, approvals, and centralized admin control. 🌍 Compliance, SEO & AI — Future-Ready by Default EU VAT & EU compliance — VAT validation, sequential invoice numbers, and a consent log GDPR & privacy compliance — data export, erasure requests, and order anonymization via the WordPress Privacy API Tax management — per-product, per-region tax rules with inclusive or exclusive pricing Built-in SEO addon — dual-mode engine that integrates with Yoast, Rank Math, AIOSEO, and SEOPress, or works standalone, with REST support for headless storefronts AI content generation — native WordPress AI abilities for product copy and SEO meta; runs on your own hosting with no third-party API keys required (opt-in AI add-ons for other features are listed under External services) Brand management — organize and display products by brand for multi-manufacturer stores 🛠️ Developer-Friendly & Admin-First Webhooks — push order, customer, and subscription events to CRMs and automation tools WP-CLI support — manage your store from the command line, including demo-content seeders Admin global search & command palette — jump to any setting instantly with Cmd/Ctrl+K Migration tool — import products, customers, and orders from any eCommerce without breaking your layout CSV import / export — bulk-manage products, customers, and orders Activity & error logger — debug payments and monitor store operations GeoIP & location-based commerce — smarter shipping, currency, and checkout by location Email notifications — branded, customizable transactional emails with no code Setup wizard — configure payments and core settings in minutes Note: StoreEngine’s eCommerce blocks require the free aBlocks plugin — the modern Gutenberg website builder. 💥 Why StoreEngine Instead of Stacking Plugins Most WordPress ecommerce setups need five or more plugins — one for subscriptions, one for memberships, one for invoicing, another for POS or inventory — each adding cost, bloat, and conflicts. StoreEngine is built from the ground up to solve that. Checkout, cart, coupons, product filtering, and login are all native Gutenberg blocks, so you control your entire store flow without code. Business-critical features like subscriptions, memberships, webhooks, invoicing, affiliates, and POS activate with a single click. The result is a lighter, faster, more secure, and future-ready way to run commerce on WordPress. Get Started With StoreEngine From your first digital download to a multi-location retail operation, StoreEngine grows with you — one fast plugin instead of a dozen. Install StoreEngine today, run your setup wizard, and start selling in minutes. Join the thriving StoreEngine community of entrepreneurs, creators, and developers building scalable, secure online stores worldwide. Stay connected for the latest updates and insights: 👉 Community Forum 👉 Our Official Facebook Page 👉 Join our Facebook Group 👉 Follow us on Twitter / X 👉 Connect on LinkedIn 👉 Our Official Support 👉 Video Tutorials 👉 Public Roadmap External services StoreEngine can connect to a number of third-party services. Everything in this list is optional, off by default, and only activates when you turn on the corresponding addon or paste in your own URL / credentials. No store data leaves your site until you do. Payment providers — Stripe, PayPal, Paddle, Razorpay, Mollie, Paystack, Square. Enabled per gateway on Settings → Payment methods. Order, customer and payment details are sent to the gateway you choose. See each provider’s privacy policy and terms of service for details. Shipping carriers / couriers — DHL, UPS, FedEx and the regional couriers you enable on Settings → Shipping. Order address and parcel details are sent only to the carriers you turn on. IP geolocation — only when Settings → “Default customer location” is set to a geolocation option. If no local MaxMind database is available, the visitor’s IP address is sent to one of these lookup services to find their country: ipinfo.io (privacy), freeipapi.com (privacy), ipapi.co (privacy), ipwhois.app (privacy). When the site runs on a local or private network, the store’s own public IP is first looked up through ipify, ipecho.net, ident.me or tnedi.me; only the request itself is sent. MaxMind GeoLite2 — when you enter a MaxMind license key for geolocation, the key is validated with MaxMind and the GeoLite2 country database is downloaded from download.maxmind.com and refreshed periodically. Only the license key is sent. Terms, privacy policy. EU VAT number validation — when the EU VAT addon is enabled and a customer enters a VAT number at checkout, the VAT number and its country code are sent to the European Commission’s VIES service (privacy) or, for UK numbers, to HMRC’s VAT check API (privacy). Currency exchange rates — when the Multi-Currency addon is set to update rates automatically, the store’s base currency (and your API key, where the provider needs one) is sent to the provider you pick: Frankfurter (no key), Open Exchange Rates (terms, privacy), ExchangeRate-API (terms) or CurrencyBeacon (terms). CAPTCHA — when the CAPTCHA addon is enabled for a form, the provider’s script is loaded on that form, and the visitor’s CAPTCHA response token and IP address are sent to the provider to verify it: Google reCAPTCHA (terms, privacy), Cloudflare Turnstile (terms, privacy) or hCaptcha (terms, privacy). Invoice PDF fonts — when an admin clicks “Download fonts” in the Invoice addon settings, a font archive (TTF files only, no code) is downloaded from kodezen.com so PDFs can render non-Latin scripts. No site data is sent. Terms, privacy policy. Store digest webhook / Slack — if you paste an https webhook URL or Slack incoming-webhook URL into Settings → Marketing → Store Digest, the digest payload (KPIs, top products, orders needing attention) is POSTed to that URL on each scheduled send. Leave the fields empty and nothing is sent. Store digest AI summary (opt-in) — when “AI insights” is enabled on Settings → Marketing → Store Digest, a short JSON blob of the period’s KPIs, top three products and attention counts is sent to the AI endpoint configured by the AI addon so it can write one summary paragraph. Off by default; turning it off removes the request entirely. Native “AI content generation” uses the built-in WordPress AI abilities on your own hosting; it does not require third-party API keys and does not send data to Kodezen. Update server — StoreEngine Pro and the paid addons check for updates against Kodezen’s update server using the license key you entered. Only the license key, site URL and the plugin / addon versions are sent. The free StoreEngine plugin updates through WordPress.org. Please consult each service’s privacy policy and terms of service before enabling it. StoreEngine itself does not phone home from the free wordpress.org build without your explicit action. Credits StoreEngine’s optional geolocation feature uses GeoLite2 data created by MaxMind, available from https://www.maxmind.com.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C