PLUGIN SECURITY
Is Hub Core safe?
Everything you need to launch an online store in days and keep it growing for years. From your first sale to millions in revenue, Woo is with you.
What this plugin does
- Slug:
hub-core - Author: Automattic
- 7000000+ active installs
- 90/100 rating (4820 reviews on wordpress.org)
- 459588434 all-time downloads
- On WordPress.org since 2011-09-27
ecommerceonline storesell onlineshopshopping cart
Maintenance status
- Latest known version: 11.0.0
- Last updated: 2026-08-10 5:53pm GMT
- Tested up to WordPress: 7.0.4
- Requires PHP: 7.4+
Known vulnerabilities
1 known CVE on file for Hub Core. Reported between 2025 and 2025.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2025-68065 | Hub Core [hub-core] < 6.0.2 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | High 7.5 | < 6.0.2 | 6.0.2 | 2025-11-09 | ✓ fixed in latest |
How to fix it
Keep Hub Core updated — 11.0.0 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Popup Builder & Popup Maker for WordPress – OptinMonster Email Marketing and Lead Generation — 1000000+ active installs — 86/100 (815) — max PHP 8.4
- WooCommerce PayPal Payments — 800000+ active installs — 56/100 (577) — max PHP 8.4
- Mailchimp for WooCommerce — 200000+ active installs — 80/100 (725) — max PHP 8.4
- WPML Multilingual & Multicurrency for WooCommerce — 100000+ active installs — 84/100 (453)
- Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress — 100000+ active installs — 62/100 (938)
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.