PLUGIN SECURITY
Is Woo Checkout For Digital Goods safe?
Known vulnerabilities, PHP compatibility and safer alternatives for the Woo Checkout For Digital Goods WordPress plugin — checked against WP Clinic's local security database.
Plugin details
- Slug:
woo-checkout-for-digital-goods - Requires PHP: 7.2+
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
- Digital Goods (Checkout Field Editor) for WooCommerce Checkout [woo-checkout-for-digital-goods] < 2.2 [CVE-2018-11633, WordPress Woo Checkout for Digital Goods plugin <= 2.1 - Cross-site request forgery (CSRF) vulnerability, Digital Goods < 2.2 - Cross-Site Request Forgery, WooCommerce Checkout For Digital Goods <= 2.1 - CSRF to Settings Change]
- Digital Goods (Checkout Field Editor) for WooCommerce Checkout [woo-checkout-for-digital-goods] < 3.6.4 [WordPress WooCommerce Checkout For Digital Goods plugin <= 3.6.3 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability]
- Digital Goods (Checkout Field Editor) for WooCommerce Checkout [woo-checkout-for-digital-goods] < 3.6.4 [WordPress WooCommerce Checkout For Digital Goods plugin <= 3.6.3 - Sensitive Information Disclosure vulnerability]
- Digital Goods (Checkout Field Editor) for WooCommerce Checkout [woo-checkout-for-digital-goods] < 3.6.4 [Freemius SDK <= 2.4.2 - Missing Authorization Checks]
- Digital Goods (Checkout Field Editor) for WooCommerce Checkout [woo-checkout-for-digital-goods] < 3.7.1 [CVE-2023-33999, WordPress WooCommerce Checkout For Digital Goods Plugin <= 3.7.0 is vulnerable to Cross Site Scripting (XSS)]
Vulnerabilities are matched against the exact installed version when it's known. Always keep the plugin updated to the latest release.
Safer / more established alternatives
- Checkout Field Editor (Checkout Manager) for WooCommerce — 400000+ active installs — max PHP 8.4
- Custom WooCommerce Checkout Fields Editor — 2000+ active installs — max PHP 8.4
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.