Compare products side by side -- only real, published, publicly visible products are ever shown, re-checked fresh every time.
A one-click upsell on the order-received page -- the original order is always verified by its real key, the price always computed server-side.
Let customers request their own data be exported or erased from My Account, via WordPress's own core privacy-request system.
Role-based wholesale prices for WooCommerce with a gated application form — the wholesale role is only ever granted by an admin approval.
Turn a WooCommerce store into a multi-vendor marketplace. Vendors can only ever touch their own products, order line items, and earnings -- enforced by WordPress's own core capability system and explicit ownership…
Continue with Google login for WooCommerce -- every identity token is cryptographically verified before any account is touched.
Size charts for WooCommerce, assignable to categories or overridden per product — no image upload, capability- and nonce-gated configuration.
Sell recurring/subscription products in WooCommerce. Subscription state is always plain scalar database columns -- this plugin never calls PHP's serialize()/unserialize() on any data, closing the exact object-injection vulnerability class found in a…
Let customers recover WooCommerce download links via order number + order key — no file path is ever read from a request.
Sale countdown timers and honest low-stock labels for WooCommerce — the 'only N left' figure is read live from real stock.
Let customers request a return on their own orders -- server-computed refund amounts, no file upload anywhere.
Let customers request a custom price on any product -- only your own signed-off quote can ever become a cart price.
A server-rendered recent-sales popup for WooCommerce — no live endpoint, no PII, ever.
A specifications table for WooCommerce products — editable only by users who can already edit that specific product.
Let customers add paid extras to a product (engraving, gift wrap, size upgrades) with text, dropdown, and checkbox options. Flat-amount pricing only, no formula evaluation.
AJAX shop filters for WooCommerce (price/attribute/category/stock/rating) — every filter runs through WP_Query, never a SQL string.
Let customers upload a file (photo, artwork, PDF) with a personalized product. There is no "accept all file types" setting -- the allowed types are always a hardcoded safe list, closing the…
Let customers ask a question about a product before buying. Every field is escaped at the exact point of output, everywhere it could ever render, closing the unauthenticated stored-XSS class found in…
Sell WooCommerce products before release with a chosen availability date. A pre-order's status is derived from the order and product, never accepted from a request.
WooCommerce plugin: photo & video product reviews, closing CVE-2026-12684's unauthenticated-upload vulnerability class by construction
Passwordless email one-time-code login and signup for WooCommerce, offered alongside the normal password login. A session is only ever created after a securely-hashed, single-use, rate-limited code is verified with a constant-time comparison…
Minimum, maximum, and step order-quantity rules -- enforced server-side on every checkout path, not just in the cart page's own JS.
Export WooCommerce orders to CSV, filtered by date range and status. Every query goes through wc_get_orders() (never raw SQL) and CSV output extends WooCommerce's own WC_CSV_Exporter, so formula-injection-safe escaping comes from WooCommerce…
A one-click discounted add-on offer at checkout -- the price charged is always the admin's own configured price, never accepted from the request.
Customers earn points on completed orders and redeem them for a discount at checkout. Balance is always computed from an append-only ledger, never a value the browser can hand back to the…
Sell software license keys through WooCommerce -- keys are pasted or generated in wp-admin, never imported from an uploaded file, and one is atomically assigned to each order the moment it completes.
On-demand invoice and packing-slip documents for WooCommerce orders, printable to PDF from any browser. Every document request is authorization-checked, never trusting a bare order ID.
Sell digital gift cards redeemed through WooCommerce's own native coupon field -- no custom checkout UI, no file uploads.
WooCommerce plugin: safe formula-based product pricing, closing CVE-2026-4001's eval()-based RCE
Postcode-based delivery zone fees, resolved server-side from the shopper's own address -- never accepted from the request.
Custom order-number formatting for WooCommerce — a pure display label derived from the real order id, never a separate lookup key.
Let customers browse and check out in their own currency -- admin rates can never be changed by a bare URL parameter.
Cart-condition coupons and apply-by-link URLs for WooCommerce — a link only ever applies an existing published coupon by exact code.
Add custom text/dropdown/checkbox fields to WooCommerce checkout — classic and block Checkout, with no file-upload field type and no unauthenticated write path.
Lets customers pick a delivery date and time slot at checkout, with blocked weekdays and blackout dates. Supports both the classic and block-based Checkout.
Quantity-tiered discounts for WooCommerce — rule labels always escaped at output, discount always computed from the real price, never a request value.
Sell bookable services and appointments through WooCommerce -- closes CVE-2026-2931 by construction.