WordPress plugin

Store Toolkit – WooCommerce Extensions, Quick Enhancements & Handy Tools security & vulnerabilities

Q: Does Store Toolkit – WooCommerce Extensions, Quick Enhancements & Handy Tools have known vulnerabilities?

Yes. VulnCrest Radar lists 5 known vulnerabilities in Store Toolkit – WooCommerce Extensions, Quick Enhancements & Handy Tools: 3 high, 2 medium. At least one is not fixed in the latest version.

Q: How do I check which version of Store Toolkit – WooCommerce Extensions, Quick Enhancements & Handy Tools I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

Q: What is the most recent Store Toolkit – WooCommerce Extensions, Quick Enhancements & Handy Tools vulnerability?

CVE-2025-60204, published Jul 15, 2025: WooCommerce Store Toolkit <= 2.4.3 - Unauthenticated Local File Inclusion. Severity: High (CVSS 8.1).

Q: Is any Store Toolkit – WooCommerce Extensions, Quick Enhancements & Handy Tools vulnerability listed in CISA KEV?

No. None of the known Store Toolkit – WooCommerce Extensions, Quick Enhancements & Handy Tools vulnerabilities is currently listed in the CISA KEV catalog.

woocommerce-store-toolkit— active installsLast vulnerability Jul 15, 2025

Unpatched vulnerability in the latest version

At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.

Watch plugin

5Known vulnerabilities

Critical0
High3
Medium2
Low0

Vulnerabilities per year

All Store Toolkit – WooCommerce Extensions, Quick Enhancements & Handy Tools vulnerabilities

Store Toolkit – WooCommerce Extensions, Quick Enhancements & Handy Tools vulnerabilities
Severity	Vulnerability	CVE	Published
High8.1	Unauthenticated Local File Inclusion ≤2.4.3Update to 2.4.4	CVE-2025-60204	Jul 15, 2025
Medium6.3	Missing Authorization Checks all versionsNo patch available	CVE-2022-4974	Mar 4, 2022
Medium6.1	Reflected Cross-Site Scripting <2.3.2Update to 2.3.2	CVE-2021-25077	Jan 10, 2022
High8.8	Privilege Escalation ≤1.5.7Update to 1.5.8	CVE-2016-10923	Feb 10, 2016
High8.8	Missing Authorization ≤1.5.6Update to 1.5.7	CVE-2016-10922	Feb 8, 2016

High8.1
Unauthenticated Local File Inclusion
≤2.4.3Update to 2.4.4
CVE-2025-60204Jul 15, 2025
Medium6.3
Missing Authorization Checks
all versionsNo patch available
CVE-2022-4974Mar 4, 2022
Medium6.1
Reflected Cross-Site Scripting
<2.3.2Update to 2.3.2
CVE-2021-25077Jan 10, 2022
High8.8
Privilege Escalation
≤1.5.7Update to 1.5.8
CVE-2016-10923Feb 10, 2016
High8.8
Missing Authorization
≤1.5.6Update to 1.5.7
CVE-2016-10922Feb 8, 2016

Store Toolkit – WooCommerce Extensions, Quick Enhancements & Handy Tools: common questions

Does Store Toolkit – WooCommerce Extensions, Quick Enhancements & Handy Tools have known vulnerabilities?

Yes. VulnCrest Radar lists 5 known vulnerabilities in Store Toolkit – WooCommerce Extensions, Quick Enhancements & Handy Tools: 3 high, 2 medium. At least one is not fixed in the latest version.

How do I check which version of Store Toolkit – WooCommerce Extensions, Quick Enhancements & Handy Tools I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Store Toolkit – WooCommerce Extensions, Quick Enhancements & Handy Tools vulnerability?

CVE-2025-60204, published Jul 15, 2025: WooCommerce Store Toolkit <= 2.4.3 - Unauthenticated Local File Inclusion. Severity: High (CVSS 8.1).

Is any Store Toolkit – WooCommerce Extensions, Quick Enhancements & Handy Tools vulnerability listed in CISA KEV?

No. None of the known Store Toolkit – WooCommerce Extensions, Quick Enhancements & Handy Tools vulnerabilities is currently listed in the CISA KEV catalog.