VidShop – Shoppable Videos for WooCommerce

VidShop – Shoppable Videos for WooCommerce has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of October 2026. Their average CVSS score is 7.5, and the most serious one scores 7.5 out of 10. Severity breakdown: 0 critical and 1 high.

The most common weakness is SQL Injection, behind 1 of the records (100%).

The one issue recorded for VidShop – Shoppable Videos for WooCommerce has a vendor fix available, so running the current release closes it.

All of these findings were reported by Athiwat Tiprasaharn (Jitlada). VidShop – Shoppable Videos for WooCommerce is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSHigh
7.5/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all VidShop – Shoppable Videos for WooCommerce vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.5CVE-2026-0702

VidShop – Shoppable Videos for WooCommerce <= 1.1.4 - Unauthenticated Time-Based SQL Injection via 'fields'

Read the full analysis

Vulnerability Records

1 records
VidShop – Shoppable Videos for WooCommerce banner
Latestv1.7.0

VidShop – Shoppable Videos for WooCommerce

WPCreatix

Author

WPCreatix

5.0(6)
100/100
Last Updated
2026-10-06 (22d ago)
Active Installs
1,000+
Downloads
6,038
Requires WP
5.8+
Requires PHP
7.4+
Tested up to
WP 7.1.3
Created
2025-08-07 (1y ago)
Requires Plugins
woocommerce

Shoppable videos for WooCommerce, TikTok-style VidShop adds a swipeable product video gallery to your WooCommerce store — like a TikTok feed of your products. Customers swipe through videos, tap a product they like, and check out without leaving the player. It fits any store that sells visual products: fashion, beauty, electronics, or home décor. See it on a live store: Interactive Demo Want more? Upgrade to VidShop Pro What VidShop does Swipe between videos like a social feed, so browsing feels like an app instead of a product grid. Buy inside the video. The cart and checkout open right in the player. See what’s working: views, watch time, likes, and add-to-carts. Built for phones first, and it works on desktop with a mouse. No code to set up. Runs on the WooCommerce products you already have. No footage? Make a product video with AI from a product photo. Works with AI assistants like Claude over MCP, so you can ask for your analytics or publish a draft from a chat (details below). Features Video feeds Build a feed step by step — pick videos, layout, colors, and shopping behavior — with a live preview that shows exactly what shoppers will see Save it and embed it anywhere with one small shortcode: [vidshop id="123"] Edit a saved feed and every page using it updates — no shortcode changes Duplicate feeds, copy shortcodes, and manage everything from one screen Layouts: grid, carousel (video slider), inline (TikTok-style feed), and stories Frontend Swipeable player Tappable product hotspots View counts and likes Cart and checkout inside the player Product variations Works on phones and desktops Products Any number of products per video Variable products Live inventory sync One-tap add to cart Analytics Views, total and unique Watch time, average and total Likes, total and unique Add-to-cart counts Product views Your top videos and products Video management Publish, draft, or trash a video Upload from the Media Library or link a URL Link products to each video Bulk actions and quick edit AI video generation Generate shoppable videos with AI when you don’t have footage. Pick a WooCommerce product, choose a style, and VidShop builds a short vertical video from its image, then saves it to your library as a draft linked to that product. You review it and publish when it looks right. A built-in AI video generator turns a product photo into a short vertical video Choose a style template, or let Auto match one to the product Set the length and pick background music or silent Finished videos save to your library as drafts, linked to the product A progress banner tracks renders while you keep working Your first video is free with a WPCreatix account; VidShop Pro covers ongoing generation Branding Colors that match your store Responsive layouts Works with touch and mouse Setup in four steps 1. Add your video. Upload it or paste a URL, then set a thumbnail. 2. Connect products. Pick the WooCommerce products to link. 3. Build a video feed. Choose which videos to show, the layout, and the colors — with a live preview. 4. Go live. Paste the feed’s shortcode anywhere on your site. Example shortcodes: [vidshop id="123"] [vsfw-videos videos="all" type="grid" color-schema="#1e40af"] [vsfw-videos videos="123,456,789" type="carousel" color-schema="#e11d48"] [vsfw-videos videos="all" type="inline" color-schema="#10b981"] [vsfw-videos videos="all" type="stories" color-schema="#1e40af" autoplay="yes" loop="yes"] Performance and compatibility Lazy loading and caching for speed Works with common caching and CDN plugins Mobile-first, responsive design Clean code with hooks for developers Translation-ready Works with AI assistants like Claude and Cursor (MCP) VidShop registers its admin operations with the WordPress Abilities API, which is part of WordPress core since 6.9. Add the free MCP Adapter plugin from the WordPress project and MCP clients that sign in with a WordPress Application Password (Claude Desktop, Claude Code, Cursor) can work with your store’s videos in plain English. Verified with Claude Code. What an AI assistant can do: List your videos, with the products attached to each, and open one with its full product details Rename a video, swap its thumbnail, publish or unpublish it, and attach products Restore a video from the trash List your saved video feeds with their shortcodes; rename one, change its status or its display settings Read analytics: views, likes, watch time, add-to-carts, top videos and products, site-wide or per feed Check the AI connection: plan, credit balance, the credit price per video length, and what is rendering right now Read the plugin settings Try prompts like: “Which videos had the most add-to-carts this month?” “Publish the draft video for the blue hoodie and attach the matching hat.” “Give me the shortcode for the homepage feed.” What it deliberately cannot do: Trash a video or start an AI render. Trashing destroys, and a render spends credits, so both are off MCP by default. If you want them, you expose them yourself with a few lines of code; the plugin never does it for you. Create a video, permanently delete one, empty the trash, create or delete a feed, connect the cloud account or change settings. None of these are offered to agents at all. They stay in wp-admin. Act as anyone but an administrator. Every operation checks the administrator capability, and a filter can require more than that, never less. What you need: WordPress 6.9 or newer, the free MCP Adapter plugin (not bundled with VidShop and not required), and a WordPress Application Password for a dedicated admin user (Users > Profile > Application Passwords). On the same machine, WP-CLI works too. Nothing changes for sites that skip this: on older WordPress, or without the adapter, VidShop runs exactly as before. Who it’s for Fashion and apparel: show clothes moving on a person Beauty and cosmetics: before-and-after and how-to-use clips Home and décor: products in a real room Electronics and tech: features and unboxing Lifestyle products: the kind of thing people buy after seeing it used

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C