Variation Swatches for WooCommerce Security & Risk Analysis

wordpress.org/plugins/product-variation-swatches-for-woocommerce

Variation Swatches for WooCommerce plugin adds button, Image, radio, and color swatches to your product attribute & enhance the product selection.

10K active installs v2.4.2 PHP 7.4+ WP 5.3+ Updated Oct 15, 2025
variation-swatchesvariation-swatches-for-woocommercewoocommerce-attributeswoocommerce-variationwoocommerce-variation-swatches
100
A · Safe
CVEs total1
Unpatched0
Last CVEDec 1, 2021
Safety Verdict

Is Variation Swatches for WooCommerce Safe to Use in 2026?

Generally Safe

Score 100/100

Variation Swatches for WooCommerce has a strong security track record. Known vulnerabilities have been patched promptly.

1 known CVELast CVE: Dec 1, 2021Updated 5mo ago
Risk Assessment

The 'product-variation-swatches-for-woocommerce' plugin v2.4.2 exhibits a generally good security posture with several positive indicators. The absence of unprotected AJAX endpoints, REST API routes, shortcodes, and cron events significantly limits the potential attack surface. The plugin also demonstrates strong adherence to secure coding practices with a high percentage of properly escaped output and a good number of nonce and capability checks. The presence of external HTTP requests and a single SQL query that is not prepared are minor points of concern, but the taint analysis did not reveal any critical or high-severity vulnerabilities.

Key Concerns

  • SQL query not using prepared statements
  • External HTTP requests present
Vulnerabilities
1

Variation Swatches for WooCommerce Security Vulnerabilities

CVEs by Year

1 CVE in 2021
2021
Patched Has unpatched

Severity Breakdown

Medium
1

1 total CVE

CVE-2021-42367medium · 6.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Variation Swatches for WooCommerce <= 2.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting

Dec 1, 2021 Patched in 2.1.2 (783d)
Code Analysis
Analyzed Mar 16, 2026

Variation Swatches for WooCommerce Code Analysis

Dangerous Functions
0
Raw SQL Queries
1
0 prepared
Unescaped Output
80
389 escaped
Nonce Checks
11
Capability Checks
9
File Operations
0
External Requests
1
Bundled Libraries
0

SQL Query Safety

0% prepared1 total queries

Output Escaping

83% escaped469 total outputs
Data Flows
3 unsanitized

Data Flow Analysis

5 flows3 with unsanitized paths
<class-thwvsf-admin-settings-design> (admin\class-thwvsf-admin-settings-design.php:0)
Source (user input) Sink (dangerous op) Sanitizer Transform Unsanitized Sanitized
Attack Surface

Variation Swatches for WooCommerce Attack Surface

Entry Points2
Unprotected0

AJAX Handlers 2

authwp_ajax_dismiss_thwvsf_review_request_noticeadmin\class-thwvsf-admin.php:178
authwp_ajax_thwvs_deactivation_reasonadmin\class-thwvsf-admin.php:212
WordPress Hooks 43
filterwoocommerce_product_export_column_namesadmin\class-thwvsf-admin-swatch-import-export.php:20
filterwoocommerce_product_export_row_dataadmin\class-thwvsf-admin-swatch-import-export.php:21
filterwoocommerce_csv_product_import_mapping_optionsadmin\class-thwvsf-admin-swatch-import-export.php:24
filterwoocommerce_csv_product_import_mapping_special_columnsadmin\class-thwvsf-admin-swatch-import-export.php:25
filterwoocommerce_product_importer_parsed_dataadmin\class-thwvsf-admin-swatch-import-export.php:26
actionwoocommerce_product_import_inserted_product_objectadmin\class-thwvsf-admin-swatch-import-export.php:27
actionadmin_initadmin\class-thwvsf-admin.php:33
actionadmin_headadmin\class-thwvsf-admin.php:167
actionadmin_initadmin\class-thwvsf-admin.php:168
actionadmin_noticesadmin\class-thwvsf-admin.php:169
actionadmin_footeradmin\class-thwvsf-admin.php:170
actionadmin_footeradmin\class-thwvsf-admin.php:175
actionadmin_footeradmin\class-thwvsf-admin.php:176
filterproduct_attributes_type_selectoradmin\class-thwvsf-admin.php:182
actionwoocommerce_after_edit_attribute_fieldsadmin\class-thwvsf-admin.php:184
actionwoocommerce_after_add_attribute_fieldsadmin\class-thwvsf-admin.php:185
actionwoocommerce_attribute_addedadmin\class-thwvsf-admin.php:187
actionwoocommerce_attribute_updatedadmin\class-thwvsf-admin.php:188
actioncreated_termadmin\class-thwvsf-admin.php:201
actionedit_termadmin\class-thwvsf-admin.php:202
actionwoocommerce_product_options_attributesadmin\class-thwvsf-admin.php:204
actionwoocommerce_product_option_termsadmin\class-thwvsf-admin.php:205
filterwoocommerce_product_data_tabsadmin\class-thwvsf-admin.php:207
actionwoocommerce_product_data_panelsadmin\class-thwvsf-admin.php:208
actionwoocommerce_process_product_metaadmin\class-thwvsf-admin.php:209
actionadmin_footer-plugins.phpadmin\class-thwvsf-admin.php:211
actionwoocommerce_before_add_attribute_fieldsadmin\class-thwvsf-admin.php:215
actionwoocommerce_before_edit_attribute_fieldsadmin\class-thwvsf-admin.php:216
filterwoocommerce_rest_prepare_product_objectincludes\class-thwvsf-wc-api-handler.php:19
actionplugins_loadedincludes\class-thwvsf.php:57
actioninitincludes\class-thwvsf.php:58
actionadmin_enqueue_scriptsincludes\class-thwvsf.php:139
actionadmin_menuincludes\class-thwvsf.php:140
filterwoocommerce_screen_idsincludes\class-thwvsf.php:141
filterplugin_row_metaincludes\class-thwvsf.php:143
actionwp_enqueue_scriptsincludes\class-thwvsf.php:157
actionbefore_woocommerce_initproduct-variation-swatches-for-woocommerce.php:43
actionafter_setup_themepublic\class-thwvsf-public.php:23
filterwoocommerce_dropdown_variation_attribute_options_htmlpublic\class-thwvsf-public.php:321
filterwoocommerce_dropdown_variation_attribute_options_argspublic\class-thwvsf-public.php:322
filterwoocommerce_reset_variations_linkpublic\class-thwvsf-public.php:323
filterwoocommerce_ajax_variation_thresholdpublic\class-thwvsf-public.php:324
filterwoocommerce_attributepublic\class-thwvsf-public.php:325
Maintenance & Trust

Variation Swatches for WooCommerce Maintenance & Trust

Maintenance Signals

WordPress version tested6.8.5
Last updatedOct 15, 2025
PHP min version7.4
Downloads234K

Community Trust

Rating98/100
Number of ratings85
Active installs10K
Developer Profile

Variation Swatches for WooCommerce Developer Profile

ThemeHigh

16 plugins · 579K total installs

77
trust score
Avg Security Score
97/100
Avg Patch Time
245 days
View full developer profile
Detection Fingerprints

How We Detect Variation Swatches for WooCommerce

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/product-variation-swatches-for-woocommerce/assets/admin/css/thwvsf-admin.css/wp-content/plugins/product-variation-swatches-for-woocommerce/assets/admin/css/thwvsf-admin.min.css/wp-content/plugins/product-variation-swatches-for-woocommerce/assets/admin/js/thwvsf-admin.js/wp-content/plugins/product-variation-swatches-for-woocommerce/assets/admin/js/thwvsf-admin.min.js
Script Paths
/wp-content/plugins/product-variation-swatches-for-woocommerce/assets/admin/js/thwvsf-admin.js/wp-content/plugins/product-variation-swatches-for-woocommerce/assets/admin/js/thwvsf-admin.min.js
Version Parameters
product-variation-swatches-for-woocommerce/assets/admin/css/thwvsf-admin.css?ver=product-variation-swatches-for-woocommerce/assets/admin/js/thwvsf-admin.js?ver=

HTML / DOM Fingerprints

CSS Classes
thwvsf-deactivate-link
Data Attributes
data-thwvsf-control-wrapper
JS Globals
thwvsf_var
FAQ

Frequently Asked Questions about Variation Swatches for WooCommerce