WordPress Plugin Vulnerabilities

CT Commerce <= 2.0.1 - Admin+ Stored XSS

Description

The plugin does not validate and escape some parameters, which could allow users with the admin role and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Affects Plugins

Plugin icon
ct-commerce
No known fix

References

CVE
CVE-2023-40007

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.5 (low)

Miscellaneous

Original Researcher
Nithissh S
Verified
No
WPVDB ID
e6cc2882-8bc9-41ba-83dd-5529f1ccfb42

Timeline

Publicly Published
2023-09-06 (about 2 years ago)
Added
2023-09-06 (about 2 years ago)
Last Updated
2023-09-06 (about 2 years ago)

Other

Published
Title
Published
2025-06-06
Title
Essential Addons for Elementor < 6.1.13 - Contributor+ Stored XSS via Pricing Table Widget
Published
2022-12-27
Title
Sassy Social Share < 3.3.45 - Contributor+ Stored XSS
Published
2025-10-21
Title
Photographers galleries <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-04-04
Title
Doppler Forms < 2.6.0 - Contributor+ Stored XSS
Published
2022-01-17
Title
Form Store to DB < 1.1.1 - Unauthenticated Stored Cross-Site Scripting