htrxuan - Han Tran

Let customers request their own data be exported or erased from My Account, via WordPress's own core privacy-request system.

Role-based wholesale prices for WooCommerce with a gated application form — the wholesale role is only ever granted by an admin approval.

Turn a WooCommerce store into a multi-vendor marketplace. Vendors can only ever touch their own products, order line items, and earnings -- enforced by WordPress's own core capability system and explicit ownership…

Continue with Google login for WooCommerce -- every identity token is cryptographically verified before any account is touched.

Size charts for WooCommerce, assignable to categories or overridden per product — no image upload, capability- and nonce-gated configuration.

Sell recurring/subscription products in WooCommerce. Subscription state is always plain scalar database columns -- this plugin never calls PHP's serialize()/unserialize() on any data, closing the exact object-injection vulnerability class found in a…

Let customers recover WooCommerce download links via order number + order key — no file path is ever read from a request.

Sale countdown timers and honest low-stock labels for WooCommerce — the 'only N left' figure is read live from real stock.

Let customers request a return on their own orders -- server-computed refund amounts, no file upload anywhere.

Let customers request a custom price on any product -- only your own signed-off quote can ever become a cart price.

A server-rendered recent-sales popup for WooCommerce — no live endpoint, no PII, ever.

A specifications table for WooCommerce products — editable only by users who can already edit that specific product.

Let customers add paid extras to a product (engraving, gift wrap, size upgrades) with text, dropdown, and checkbox options. Flat-amount pricing only, no formula evaluation.

AJAX shop filters for WooCommerce (price/attribute/category/stock/rating) — every filter runs through WP_Query, never a SQL string.

Let customers upload a file (photo, artwork, PDF) with a personalized product. There is no "accept all file types" setting -- the allowed types are always a hardcoded safe list, closing the…

Let customers ask a question about a product before buying. Every field is escaped at the exact point of output, everywhere it could ever render, closing the unauthenticated stored-XSS class found in…

Sell WooCommerce products before release with a chosen availability date. A pre-order's status is derived from the order and product, never accepted from a request.

WooCommerce plugin: photo & video product reviews, closing CVE-2026-12684's unauthenticated-upload vulnerability class by construction

Passwordless email one-time-code login and signup for WooCommerce, offered alongside the normal password login. A session is only ever created after a securely-hashed, single-use, rate-limited code is verified with a constant-time comparison…

Minimum, maximum, and step order-quantity rules -- enforced server-side on every checkout path, not just in the cart page's own JS.

Export WooCommerce orders to CSV, filtered by date range and status. Every query goes through wc_get_orders() (never raw SQL) and CSV output extends WooCommerce's own WC_CSV_Exporter, so formula-injection-safe escaping comes from WooCommerce…

A one-click discounted add-on offer at checkout -- the price charged is always the admin's own configured price, never accepted from the request.

Customers earn points on completed orders and redeem them for a discount at checkout. Balance is always computed from an append-only ledger, never a value the browser can hand back to the…

Sell software license keys through WooCommerce -- keys are pasted or generated in wp-admin, never imported from an uploaded file, and one is atomically assigned to each order the moment it completes.

On-demand invoice and packing-slip documents for WooCommerce orders, printable to PDF from any browser. Every document request is authorization-checked, never trusting a bare order ID.

Sell digital gift cards redeemed through WooCommerce's own native coupon field -- no custom checkout UI, no file uploads.

WooCommerce plugin: safe formula-based product pricing, closing CVE-2026-4001's eval()-based RCE

Postcode-based delivery zone fees, resolved server-side from the shopper's own address -- never accepted from the request.

Custom order-number formatting for WooCommerce — a pure display label derived from the real order id, never a separate lookup key.

Let customers browse and check out in their own currency -- admin rates can never be changed by a bare URL parameter.

Cart-condition coupons and apply-by-link URLs for WooCommerce — a link only ever applies an existing published coupon by exact code.

Add custom text/dropdown/checkbox fields to WooCommerce checkout — classic and block Checkout, with no file-upload field type and no unauthenticated write path.

Lets customers pick a delivery date and time slot at checkout, with blocked weekdays and blackout dates. Supports both the classic and block-based Checkout.

Quantity-tiered discounts for WooCommerce — rule labels always escaped at output, discount always computed from the real price, never a request value.

Sell bookable services and appointments through WooCommerce -- closes CVE-2026-2931 by construction.