Force Sell for WooCommerce Security & Risk Analysis

wordpress.org/plugins/force-sell-for-woocommerce

Force Sell for WooCommerce plugin allows you to link products to another product, so they are added to the cart together.

700 active installs v3.6.2.3 PHP 7.0+ WP 5.0+ Updated Mar 12, 2026
force-sellsell-productstied-up-productswoocommerce-force-sellwoocommerce-sell-together
100
A · Safe
CVEs total0
Unpatched0
Last CVENever
Safety Verdict

Is Force Sell for WooCommerce Safe to Use in 2026?

Generally Safe

Score 100/100

Force Sell for WooCommerce has no known CVEs and is actively maintained. It's a solid choice for most WordPress installations.

No known CVEs Updated 23d ago
Risk Assessment

The "force-sell-for-woocommerce" plugin v3.6.2.3 exhibits a generally good security posture with several positive indicators. The static analysis reveals a well-defined attack surface, with all identified entry points (AJAX handlers and shortcodes) appearing to have authentication checks in place. The presence of numerous nonce and capability checks further strengthens this defense. The absence of critical or high-severity taint flows, along with no recorded vulnerabilities or CVEs, suggests a mature and relatively secure codebase.

However, there are areas for concern that prevent a perfect score. The use of the `unserialize` function is a notable risk, as it can lead to deserialization vulnerabilities if not handled with extreme caution and input validation. Furthermore, while SQL queries are present, only a third utilize prepared statements, leaving room for potential SQL injection if the input is not meticulously sanitized. The relatively low percentage of properly escaped output also presents a risk of Cross-Site Scripting (XSS) vulnerabilities.

Overall, the plugin benefits from a lack of historical vulnerabilities and a proactive approach to authentication. The primary weaknesses lie in the potential for deserialization, insecure SQL queries, and insufficient output escaping. Addressing these specific code signals would significantly improve the plugin's security.

Key Concerns

  • Use of unserialize function
  • Low percentage of prepared SQL statements
  • Low percentage of properly escaped output
Vulnerabilities
None known

Force Sell for WooCommerce Security Vulnerabilities

No known vulnerabilities — this is a good sign.
Code Analysis
Analyzed Mar 16, 2026

Force Sell for WooCommerce Code Analysis

Dangerous Functions
1
Raw SQL Queries
2
1 prepared
Unescaped Output
135
103 escaped
Nonce Checks
15
Capability Checks
24
File Operations
4
External Requests
5
Bundled Libraries
0

Dangerous Functions Found

unserialize$error_log = unserialize(preg_replace('/R:\d+/', 's:18:"RECURSION DETECTED"', serialize(self::$errorberocket\includes\updater.php:128

SQL Query Safety

33% prepared3 total queries

Output Escaping

43% escaped238 total outputs
Data Flows
All sanitized

Data Flow Analysis

8 flows
<framework> (berocket\framework.php:0)
Source (user input) Sink (dangerous op) Sanitizer Transform Unsanitized Sanitized
Attack Surface

Force Sell for WooCommerce Attack Surface

Entry Points14
Unprotected0

AJAX Handlers 13

authwp_ajax_brfr_get_export_settingsberocket\includes\admin\import_export.php:5
authwp_ajax_brfr_set_import_settingsberocket\includes\admin\import_export.php:6
authwp_ajax_brfr_get_import_backupsberocket\includes\admin\import_export.php:7
authwp_ajax_brfr_restore_import_backupsberocket\includes\admin\import_export.php:8
authwp_ajax_berocket_admin_close_noticeberocket\includes\admin_notices.php:1199
authwp_ajax_berocket_subscribe_emailberocket\includes\admin_notices.php:1200
authwp_ajax_berocket_rate_stars_closeberocket\includes\admin_notices.php:1208
authwp_ajax_berocket_feature_request_sendberocket\includes\admin_notices.php:1209
authwp_ajax_berocket_error_notices_getberocket\includes\error_notices.php:5
authwp_ajax_berocket_information_close_noticeberocket\includes\information_notices.php:198
authwp_ajax_br_test_keyberocket\includes\updater.php:46
authwp_ajax_br_test_keysberocket\includes\updater.php:47
authwp_ajax_brfocesell_divi_moduledivi\includes\ForcesellExtension.php:12

Shortcodes 1

[br_force_sell] main.php:75
WordPress Hooks 133
filterplugins_listberocket\framework.php:84
filterBeRocket_updater_add_pluginberocket\framework.php:105
filterberocket_admin_notices_rate_stars_pluginsberocket\framework.php:106
actioninitberocket\framework.php:107
actioninitberocket\framework.php:110
actionwp_headberocket\framework.php:111
actionwp_footerberocket\framework.php:112
actionadmin_initberocket\framework.php:113
actionadmin_menuberocket\framework.php:114
actionadmin_enqueue_scriptsberocket\framework.php:115
actionberocket_enqueue_mediaberocket\framework.php:116
filterplugin_row_metaberocket\framework.php:122
filteris_berocket_settings_pageberocket\framework.php:123
actionplugins_loadedberocket\framework.php:128
actionsanitize_comment_cookiesberocket\framework.php:129
actioninstall_plugins_pre_plugin-informationberocket\framework.php:130
filterberocket_admin_notices_subscribe_pluginsberocket\framework.php:132
filterBeRocket_admin_init_user_capabilitiesberocket\framework.php:135
filterberocket_sanitize_array_predefineberocket\framework.php:136
filterberocket_sanitize_array_ksesberocket\framework.php:137
filterberocket_sanitize_array_ksesberocket\framework.php:140
actionbefore_woocommerce_initberocket\framework.php:150
filterloop_shop_per_pageberocket\framework.php:391
actionupgrader_process_completeberocket\framework.php:499
actionadmin_footerberocket\framework.php:1158
actionwp_footerberocket\framework.php:1159
actionadmin_initberocket\framework.php:1273
actionadmin_bar_menuberocket\includes\admin\admin_bar.php:8
actionwp_footerberocket\includes\admin\admin_bar.php:9
filterberocket_admin_bar_plugins_databerocket\includes\admin\admin_bar.php:149
actionBeRocket_framework_updater_account_form_afterberocket\includes\admin\import_export.php:4
filterberocket_admin_notice_is_display_noticeberocket\includes\admin_notices.php:75
filterberocket_admin_notice_is_display_notice_priorityberocket\includes\admin_notices.php:76
actionadmin_noticesberocket\includes\admin_notices.php:1198
actionadmin_noticesberocket\includes\admin_notices.php:1207
actionberocket_rate_plugin_windowberocket\includes\admin_notices.php:1210
actionberocket_related_plugins_windowberocket\includes\admin_notices.php:1211
actionberocket_above_admin_settingsberocket\includes\admin_notices.php:1212
actionberocket_feature_request_windowberocket\includes\admin_notices.php:1213
actionadmin_footerberocket\includes\admin_notices.php:1285
actionadmin_footerberocket\includes\admin_notices.php:1493
actionadmin_footerberocket\includes\admin_notices.php:1922
actionadmin_footerberocket\includes\admin_notices.php:2079
actioninitberocket\includes\custom_post\enable_disable.php:9
actionadmin_initberocket\includes\custom_post\enable_disable.php:10
actionpost_action_enableberocket\includes\custom_post\enable_disable.php:13
actionpost_action_disableberocket\includes\custom_post\enable_disable.php:14
filterpost_classberocket\includes\custom_post\enable_disable.php:16
filterpre_get_postsberocket\includes\custom_post\enable_disable.php:18
actionpre_get_postsberocket\includes\custom_post\sortable.php:22
actionin_admin_footerberocket\includes\custom_post\sortable.php:117
actioninitberocket\includes\custom_post.php:58
filterinitberocket\includes\custom_post.php:59
filteradmin_initberocket\includes\custom_post.php:60
filterwp_insert_post_databerocket\includes\custom_post.php:61
filterBeRocket_admin_init_user_capabilitiesberocket\includes\custom_post.php:71
actionadd_meta_boxesberocket\includes\custom_post.php:128
actionsave_postberocket\includes\custom_post.php:129
filterpost_row_actionsberocket\includes\custom_post.php:130
filterlist_table_primary_columnberocket\includes\custom_post.php:131
actionadmin_enqueue_scriptsberocket\includes\custom_post.php:133
filteris_berocket_settings_pageberocket\includes\custom_post.php:135
actionadmin_footerberocket\includes\custom_post.php:162
actionadmin_noticesberocket\includes\information_notices.php:197
actionadmin_initberocket\includes\updater.php:18
filterwoocommerce_addons_sectionsberocket\includes\updater.php:27
filteris_berocket_settings_pageberocket\includes\updater.php:28
actionadmin_footerberocket\includes\updater.php:30
actionadmin_headberocket\includes\updater.php:39
actionadmin_menuberocket\includes\updater.php:40
actionadmin_menuberocket\includes\updater.php:41
actionnetwork_admin_menuberocket\includes\updater.php:42
actionadmin_initberocket\includes\updater.php:43
filterpre_set_site_transient_update_pluginsberocket\includes\updater.php:44
filterplugins_api_resultberocket\includes\updater.php:45
filterhttp_request_host_is_externalberocket\includes\updater.php:48
actionadmin_footerberocket\includes\updater.php:51
actionwp_footerberocket\includes\updater.php:52
filterberocket_display_additional_noticesberocket\includes\updater.php:92
filtercustom_menu_orderberocket\includes\updater.php:98
filterberocket_admin_notice_is_display_noticeberocket\includes\updater.php:102
filterberocket_admin_notice_is_display_notice_priorityberocket\includes\updater.php:103
filterplugins_api_resultberocket\includes\updater.php:109
actioninitberocket\includes\updater.php:1413
actionadmin_enqueue_scriptsberocket\sale\sale.php:4
actionsave_postincludes\deprecated\force_sell_single.php:4
actionwoocommerce_product_options_relatedincludes\deprecated\force_sell_single.php:5
filterberocket_force_sell_check_result_otherincludes\deprecated\force_sell_single.php:6
filterberocket_force_sell_check_result_add_to_cartincludes\deprecated\force_sell_single.php:7
filterberocket_force_sell_check_result_validate_add_to_cartincludes\deprecated\force_sell_single.php:8
filterberocket_force_sell_check_linked_productsincludes\deprecated\force_sell_single.php:9
filterberocket_force_sell_check_result_force_productsincludes\deprecated\force_sell_single.php:10
actionwoocommerce_after_cart_item_quantity_updateincludes\deprecated\old_add_force_sell.php:5
actionwoocommerce_before_cart_item_quantity_zeroincludes\deprecated\old_add_force_sell.php:6
actionwoocommerce_stock_amount_cart_itemincludes\deprecated\old_add_force_sell.php:7
filterwoocommerce_cart_item_remove_linkincludes\deprecated\old_add_force_sell.php:8
filterwoocommerce_cart_item_quantityincludes\deprecated\old_add_force_sell.php:9
actionwoocommerce_cart_item_removedincludes\deprecated\old_add_force_sell.php:10
actionwoocommerce_cart_item_restoredincludes\deprecated\old_add_force_sell.php:11
filterwoocommerce_get_cart_item_from_sessionincludes\deprecated\old_add_force_sell.php:12
filterwoocommerce_get_item_dataincludes\deprecated\old_add_force_sell.php:13
actionwoocommerce_after_add_to_cart_buttonincludes\deprecated\old_add_force_sell.php:14
actionberocket_force_sell_echo_linked_productsincludes\deprecated\old_add_force_sell.php:15
actionwoocommerce_add_to_cartincludes\deprecated\old_add_force_sell.php:16
filterwoocommerce_add_to_cart_validationincludes\deprecated\old_add_force_sell.php:18
actionwoocommerce_after_cart_item_quantity_updateincludes\deprecated\old_add_force_sell.php:139
actionwoocommerce_before_cart_item_quantity_zeroincludes\deprecated\old_add_force_sell.php:154
actionwp_loadedincludes\force-sell-types\add_force_sell.php:5
actionwoocommerce_after_calculate_totalsincludes\force-sell-types\add_force_sell.php:6
filterberocket_force_sell_condition_mode_normalincludes\force-sell-types\add_force_sell.php:7
filterberocket_force_sell_condition_mode_cartincludes\force-sell-types\add_force_sell.php:8
filterberocket_force_sell_condition_mode_eachincludes\force-sell-types\add_force_sell.php:9
filterberocket_force_sell_check_result_otherincludes\force-sell-types\add_force_sell.php:10
filterberocket_force_sell_check_result_add_to_cartincludes\force-sell-types\add_force_sell.php:11
filterberocket_force_sell_check_result_validate_add_to_cartincludes\force-sell-types\add_force_sell.php:12
filterberocket_force_sell_check_result_force_productsincludes\force-sell-types\add_force_sell.php:13
actionwoocommerce_add_to_cartincludes\force-sell-types\add_force_sell.php:14
filterwoocommerce_cart_item_remove_linkincludes\force-sell-types\add_force_sell.php:15
filterwoocommerce_cart_item_quantityincludes\force-sell-types\add_force_sell.php:16
filterwoocommerce_get_item_dataincludes\force-sell-types\add_force_sell.php:17
filterBeRocket_force_sell_custom_post_after_conditionsincludes\force-sell-types\add_force_sell.php:18
actionberocket_force_sell_echo_linked_productsincludes\force-sell-types\add_force_sell.php:24
filterwoocommerce_add_to_cart_validationincludes\force-sell-types\add_force_sell.php:26
filterbrfr_data_berocket_force_sell_custom_postincludes\paid.php:8
filterberocket_calculate_quantity_force_sellincludes\paid.php:9
filterberocket_correct_cart_linked_final_qtyincludes\paid.php:10
filterberocket_check_quantity_min_force_sellincludes\paid.php:11
filterberocket_change_quantity_force_sellincludes\paid.php:12
actionberocket_force_sell_version_diffincludes\paid.php:13
filterberocket_force_sell_custom_post_conditions_listincludes\tripwire.php:8
actionwidgets_initmain.php:73
filterBeRocket_updater_menu_order_custom_postmain.php:76
actiondivi_extensions_initmain.php:77
Maintenance & Trust

Force Sell for WooCommerce Maintenance & Trust

Maintenance Signals

WordPress version tested6.9.4
Last updatedMar 12, 2026
PHP min version7.0
Downloads36K

Community Trust

Rating100/100
Number of ratings16
Active installs700
Developer Profile

Force Sell for WooCommerce Developer Profile

BeRocket

22 plugins · 139K total installs

78
trust score
Avg Security Score
99/100
Avg Patch Time
381 days
View full developer profile
Detection Fingerprints

How We Detect Force Sell for WooCommerce

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/force-sell-for-woocommerce/assets/css/backend.css/wp-content/plugins/force-sell-for-woocommerce/assets/css/frontend.css/wp-content/plugins/force-sell-for-woocommerce/assets/js/backend.js/wp-content/plugins/force-sell-for-woocommerce/assets/js/frontend.js
Script Paths
/wp-content/plugins/force-sell-for-woocommerce/assets/js/backend.js/wp-content/plugins/force-sell-for-woocommerce/assets/js/frontend.js
Version Parameters
/wp-content/plugins/force-sell-for-woocommerce/assets/css/backend.css?ver=/wp-content/plugins/force-sell-for-woocommerce/assets/css/frontend.css?ver=/wp-content/plugins/force-sell-for-woocommerce/assets/js/backend.js?ver=/wp-content/plugins/force-sell-for-woocommerce/assets/js/frontend.js?ver=

HTML / DOM Fingerprints

CSS Classes
berocket_framework_notice
JS Globals
BeRocket_force_sell_obj
FAQ

Frequently Asked Questions about Force Sell for WooCommerce