PLUGIN SECURITY
Is Facebook For Woocommerce safe?
Reach more customers and drive sales on Facebook, Instagram and WhatsApp with the official Meta for WooCommerce plugin.
What this plugin does
- Slug:
facebook-for-woocommerce - Author: Facebook
- 400000+ active installs
- 42/100 rating (479 reviews on wordpress.org)
- 50386719 all-time downloads
- On WordPress.org since 2019-02-22
catalog syncConversions APIfacebookmetawhatsapp
Maintenance status
- Latest known version: 3.7.6
- Last updated: 2026-07-23 1:59pm GMT
- Tested up to WordPress: 7.0.4
- Requires PHP: 7.4+
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
5 known CVEs on file for Facebook For Woocommerce. Reported between 2019 and 2026.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-49059 | Meta for WooCommerce [facebook-for-woocommerce] < 3.7.1 | URL Redirection to Untrusted Site ('Open Redirect') | Medium 4.7 | < 3.7.1 | 3.7.1 | 2026-05-27 | ✓ fixed in latest |
| CVE-2026-66707 | Meta for WooCommerce [facebook-for-woocommerce] < 3.7.6 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 3.7.6 | 3.7.6 | 2026-05-27 | ✓ fixed in latest |
| CVE-2025-64296 | Meta for WooCommerce [facebook-for-woocommerce] < 3.5.8 | Missing Authorization | Unknown | < 3.5.8 | 3.5.8 | 2025-10-29 | ✓ fixed in latest |
| — | Meta for WooCommerce [facebook-for-woocommerce] < 1.9.14 | — | Unknown | < 1.9.14 | 1.9.14 | 2019-06-25 | ✓ fixed in latest |
| CVE-2019-15840 | Meta for WooCommerce [facebook-for-woocommerce] < 1.9.15 | Cross-Site Request Forgery (CSRF) | High 8.8 | < 1.9.15 | 1.9.15 | 2019-06-18 | ✓ fixed in latest |
| CVE-2019-15841, CVE-2019-15840 | Meta for WooCommerce [facebook-for-woocommerce] < 1.9.15 | Cross-Site Request Forgery (CSRF) | High 8.8 | < 1.9.15 | 1.9.15 | 2019-06-18 | ✓ fixed in latest |
How to fix it
Keep Facebook For Woocommerce updated — 3.7.6 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Meta pixel for WordPress — 400000+ active installs — 54/100 (164)
- Pixel Cat – Conversion Pixel Manager — 40000+ active installs — 80/100 (41)
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.