TillKit – Mobile POS for WooCommerce

TillKit – Mobile POS for WooCommerce has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of October 2026. Their average CVSS score is 5.3, and the most serious one scores 5.3 out of 10.

The most common weakness is Use Of Hard-Coded Password, behind 1 of the records (100%).

The one issue recorded for TillKit – Mobile POS for WooCommerce has a vendor fix available, so running the current release closes it.

All of these findings were reported by Pedro Pinho. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium
5.3/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all TillKit – Mobile POS for WooCommerce vulnerabilities before they are exploited.

Highest severity on recordCVSS 5.3CVE-2026-91078

TillKit <= 1.0.4 - Unauthenticated Privileged POS Session Hijacking

Read the full analysis

Vulnerability Records

1 records
Showing 1–1 of 1 reports
Plugin Profile
Latestv1.0.5

TillKit – Mobile POS for WooCommerce

snwebapps

Author

snwebapps

0.0(0)
0/100
Last Updated
2026-10-15 (4d ago)
Active Installs
0+
Downloads
470
Requires WP
5.8+
Requires PHP
7.4+
Tested up to
WP 7.1.3
Created
2026-06-24 (4mo ago)

Sell in your shop, at a market or pop-up using the phone in your pocket. TillKit adds a fast, PIN-protected point of sale to your existing WooCommerce store. Open it in your phone’s browser, add it to your home screen, and start taking sales. Your products, prices and stock are already there, so there is nothing to import and no monthly POS fee. The problems TillKit solves Paying for expensive POS hardware and subscriptions. Use the phone or tablet you already own. Running two systems. Online and in-store products live in one place, with no double entry. Slow, error-prone checkout. Scan a barcode or tap a product instead of typing codes. Cash that doesn’t add up. Open and close the till with a float and see the variance at the end of the shift. Bad Wi-Fi at a market stall or stockroom. Offline mode keeps selling and syncs when you reconnect. Staff with too much access. Each person logs in with their own PIN and only sees what their role allows. Who it’s for Small shops, boutiques, cafés, market stalls, pop-up stores and anyone who sells in person and online with WooCommerce. Features Mobile POS: product grid, category filters, search by name or SKU, cart drawer Barcode scanner: scan products with your phone camera Till and shift management: float tracking and a variance report on close Order history: every sale with a full item breakdown Store tab: quickly update products and stock from your phone Staff PIN login: Cashier and Manager roles Install as an app: add to home screen on Android and iOS Offline mode: keep selling without a connection, sales sync automatically Free and open source Need more? TillKit Pro adds Supervisor and Scanner Only roles, plus extra reporting across all staff. Third-Party Libraries QuaggaJS v0.12.1 (MIT) – barcode scanning – https://github.com/serratus/quaggaJS Chart.js v4.5.1 (MIT) – admin charts – https://github.com/chartjs/Chart.js Both are unmodified upstream builds. Plugin JavaScript is unminified; no build step is needed. Security Report vulnerabilities privately to info@snwebapps.com.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C