Vulnerabilities

TI-2024-06009 CVE-2024-6478 · GHSA-vf8r-rhw4-6q8g

CTT Expresso para WooCommerce < 3.2.13 - Admin+ Stored XSS

MEDIUM 55

The CTT Expresso para WooCommerce WordPress plugin before 3.2.13 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00326 Published 2025-05-15 Fixed in 3.2.13 CWE-79

TI-2024-06196 CVE-2024-6687 · GHSA-73q4-cgh7-2r7w

CTT Expresso para WooCommerce <= 3.2.12 - Information Exposure via Unprotected Directory

LOW 39

The CTT Expresso para WooCommerce plugin for WordPress is vulnerable to sensitive information exposure in all versions up to and including 3.2.12 via the /wp-content/uploads/cepw directory.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00415 Published 2024-08-01 No fix listed CWE-200

TI-2022-23627 CVE-2022-47589 · GHSA-6h43-gg34-mgjm

WordPress CTT Expresso para WooCommerce Plugin <= 3.2.11 is vulnerable to Cross Site Scripting (XSS)

LOW 27

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in this.Functional CTT Expresso para WooCommerce plugin <= 3.2.11 versions.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00392 Published 2023-03-23 No fix listed CWE-79

Vulnerabilities

Filters

CTT Expresso para WooCommerce < 3.2.13 - Admin+ Stored XSS

CTT Expresso para WooCommerce <= 3.2.12 - Information Exposure via Unprotected Directory

WordPress CTT Expresso para WooCommerce Plugin <= 3.2.11 is vulnerable to Cross Site Scripting (XSS)