CVE-2024-13362
Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
- State
- Published
- Severity
- 6.1 Medium
- Published
- May 1, 2026
- Updated
- May 1, 2026
- Reserved
- Jan 13, 2025
Description
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.1 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | Wordfence |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
Go Fetch Jobs (for WP Job Manager)sebet |
|
Dynamic Copyright Year5starplugins |
|
Code Managerpeterschulznl |
|
Advanced Scrollbar – Custom Scrollbar Styling and Behaviorbplugins |
|
Goal Tracker – Custom Event Tracking for GA4yuvalo |
|
Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluentessekia |
|
WP Page Templatesjosevega |
|
Payment Gateway for ACBA BANKhkdigitalagency |
|
Dracula Dark Mode – Accessibility, Reading Mode & Dark Mode for WordPressprinceahmed |
|
Forumax – AI Powered Advanced Community Forum Pluginspiderdevs |
|
Five-Star Ratings Shortcodeseezee |
|
Product Layouts for WooCommerceoxilab |
|
Meta Field Block – Display custom fields in the Block Editor without codingmr2p |
|
Custom WooCommerce Checkout Fields Editorthemelocation |
|
Open User Map100plugins |
|
WP Notification Bellwpdever |
|
Remove Add to Cart WooCommercethemelocation |
|
File Manager for Google Drive – Integrate Google Driveprinceahmed |
|
Marijuana Age Verify5starplugins |
|
RevivePress – Keep your Old Content Evergreeninfosatech |
|
Restaurant & Cafe Addon for Elementornicheaddons |
|
Send Users Email – Email Subscribers, Email Marketing Newsletterparetodigital |
|
Unlimited Elements For Elementorunitecms |
|
Role Based Pricing for Woo by Meow Crewmeowcrew |
|
Primary Addon for Elementornicheaddons |
|
Featured Images in RSS for Mailchimp & More5starplugins |
|
Image Alt Text Manager – Bulk & Dynamic Alt Tags For image SEO Optimization + AIwpsaad |
|
Message Filter for Contact Form 7kofimokome |
|
Embedder for Google Reviewsparetodigital |
|
MapGeo – Interactive Geo Mapsinteractivegeomaps |
|
WPBITS Addons For Elementor Page Builderwpbits |
|
Widgets on Pagestoddhalfpenny |
|
Spotlight Social Feeds – Block, Shortcode, and Widgetrebelcode |
|
WOW Styler for CF7 – Visual Styler for Contact Form 7 Formstobias_conrad |
|
AI Bud – AI Content Generator, AI Chatbot, ChatGPT, Gemini, GPT-4owebfactory |
|
Text To Speech TTS Accessibilityhasanazizul |
|
Easy Age Verify5starplugins |
|
AI Puffer – Chat. Create. Automate. (formerly AI Power)senols |
|
Justified Gallerydamian-gora |
|
Mapster WP Mapsmapster |
|
StreamWeasels Twitch Integrationstreamweasels |
|
XT Variation Swatches for WooCommercexplodedthemes |
|
bBlocks – Essential Gutenberg Blocks & Patterns Collectionbplugins |
|
URL Shortify – Simple and Easy URL Shortenerkaizencoders |
|
Kikote – Location Picker at Checkout & Google Address AutoFill Plugin for WooCommerceuriahs-victor |
|
Geo Mashupcyberhobo |
|
Disable Payment Methods based on cart conditions for WooCommercejosevega |
|
Automatic Internal Links for SEO by Paguppagup |
|
Full Screen Backgroundenweby |
|
Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kitslitonice13 |
|
Radio Player – Live Shoutcast, Icecast and Any Audio Stream Playerprinceahmed |
|
Carousel, Recent Post Slider and Banner Sliderspicethemes |
|
Bulk Auto Image Alt Text (Alt tag, Alt attribute) optimizer (image SEO)pagup |
|
XT Quick View for WooCommercexplodedthemes |
|
Smart phone field for Gravity Formspluginscafe |
|
Notification Bar, Announcement and Cookie Notice WordPress Plugin – FooBarfooplugins |
|
PDF Poster – Display PDF Files with Custom Viewerbplugins |
|
Events Addon for Elementornicheaddons |
|
HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Playerbplugins |
|
Glossarymte90 |
|
Restrict – membership, site, content and user access restrictions for WordPresstickera |
|
Custom PHP Settingscyclonecode |
|
WP Meta and Date Removerprasadkirpekar |
|
Anti-Spam Protection – No API Key, GDPR Friendlyfullworks |
|
Premmerce Permalink Manager for WooCommercepremmerce |
|
Music Player for Elementor – Audio Player & Podcast Playersmartwpress |
|
TopNewsWp – Display Tikcer News, RSS Feed Widget and Many Moremhmrajib |
|
Ocean Extraoceanwp |
|
Gallery by FooGalleryfooplugins |
|
Automatic YouTube Galleryplugins360 |
|
EazyDocs – AI Powered Knowledge Base, Wiki, Documentation & FAQ Builderspiderdevs |
|
Team Members – A WordPress Team Plugin with Gallery, Grid, Carousel, Slider, Table, List, and Moresamdani |
|
Radio Station by netmix® – Manage and play your Show Schedule in WordPress!tonyzeoli |
|
StoreCustomizer – A plugin to Customize all WooCommerce Pageskaira |
|
Joli Table Of Contentswpjoli |
|
GA4WP – Analytics Dashboard for the Websitepassionatebrains |
|
Place Order Without Payment for WooCommercenitin247 |
|
Better Messages – Live Chat, Chat Rooms, Real-Time Messaging & Private Messageswordplus |
|
Share This Imagemihail-barinov |
|
Inavii Social Feedinavii |
|
Lightbox & Modal Popup WordPress Plugin – FooBoxfooplugins |
|
XT Floating Cart for WooCommercexplodedthemes |
|
WP Mobile Menu – The Mobile-Friendly Responsive Menutakanakui |
|
AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading & Image Optimizationpassionatebrains |
|
Independent Analyticsbensibley |
|
Knowledge Base documentation & wiki plugin – BasePress Docscodesavory |
|
Internal Link Juicer: SEO Auto Linker for WordPressdavidanderson |
|
Bulk Edit Posts and Products in Spreadsheetjosevega |
|
Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile Appsaadiqbal |
|
TablePress – Tables in WordPress made easytobiasbg |
|
Ultimeterbouncingsprout |
|
TreePress – Easy Family Trees & Ancestor Profilesblackandwhitedigital |
|
Pay For Post with WooCommercemattpramschufer |
|
Post to Google My Business (Google Business Profile)koen12344 |
|
WP Coupons and Deals – Coupon Plugin For Affiliate Marketersimtiazrayhan |
|
Advanced Classifieds & Directory Propluginsware |
|
Mixed Media Gallery Blocksgallerycreator |
|
BlockSpare — News, Magazine and Blog Addons for (Gutenberg) Block Editorblockspare |
|
AidWP – Donation & Payment Forms (Stripe Powered)mhmrajib |
|
Logo Showcase – Responsive Logo Carousel, Logo Slider & Logo Gridinfornweb |
|
Post Slider and Post Carousel with Post Vertical Scrolling Widget – A Responsive Post Sliderpluginandplay |
|
Solid Testimonials – Testimonial Slider, Video Testimonials & Customer Reviewssamdani |
|
Team Members Showcasewpspeedo |
|
EleSpare – News, Magazine and Blog Addons for Elementorelespare |
|
Post List Designer – Category Post, Recent Post, Post Listinfornweb |
|
Blog Designer Pack – Blog, Post Grid, Post Slider, Post Carousel, Category Post, Newsinfornweb |
|
YASR – Yet Another Star Rating Plugin for WordPressdashlabsltd |
|
WPIDE – File Manager & Code Editorxplodedthemes |
|
Premmerce Product Filter for WooCommercepremmerce |
|
WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatarsafthemes |
|
Delete Posts automaticallywpmagics |
|
Menu Image, Icons made easytakanakui |
|
AWCA – The Great Analytics Insights for Your eStorepassionatebrains |
|
Announcement & Notification Banner – Bulletinmikewire_rocksolid |
|
Thank You Page for WooCommercenitin247 |
|
Contact Form 7 Multi-Step Formswebheadllc |
|
Auto-Install Free SSL – Generate & Install Free SSL Certificatesspeedify |
|
WP Books Gallery – Build Stunning Book Showcases & Libraries in Minutesmhmrajib |
|
Easy Appointment Booking & Scheduling System – Webba Booking Calendarwebba-agency |
|
WP fail2ban – Advanced Securityinvisnet |
|
Ivory Search – WordPress Search Pluginvinod-dalvi |
|
WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboardspeterschulznl |
|
Coupon Affiliates – Affiliate Plugin for WooCommerceelliotvs |
|
Security Ninja – WordPress Security & Firewallcleverplugins |
|
Checkout with Cash App on WooCommercetheafricanboss |
|
Display Eventbrite Eventsfullworks |
|
Secure Gateway for Authorize.net and WooCommerce by Pledged Pluginsmohsinoffline |
|
Easy Social Feed – Social Photos Gallery and Post Feed for WordPresssjaved |
|
WP Shortcodes Plugin — Shortcodes Ultimategn_themes |
|
WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scangowebsmarty |
|
WordPress form builder plugin for contact forms, surveys and quizzes – Tripettotripetto |
|
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d694491c-c0f5-4418-805a-db792ea4f712?source=cve
- https://plugins.trac.wordpress.org/browser/tablepress/trunk/libraries/freemius/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/widgets-on-pages/trunk/freemius/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/menu-image/trunk/freemius/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/simply-gallery-block/trunk/freemius/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/foobox-image-lightbox/tags/2.7.33/freemius/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/featured-images-for-rss-feeds/trunk/includes/freemius/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/wpide/tags/3.5.0/dist/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/add-search-to-menu/trunk/includes/freemius/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/master-addons/trunk/lib/freemius/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/foogallery/tags/2.4.27/freemius/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/ocean-extra/trunk/includes/freemius/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/internal-links/trunk/vendor/freemius/wordpress-sdk/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/interactive-geo-maps/tags/1.6.21/vendor/freemius/wordpress-sdk/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/independent-analytics/trunk/freemius/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/spotlight-social-photo-feeds/trunk/ui/freemius-pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/woo-permalink-manager/tags/2.3.11/assets/admin/js/pricing-page/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/pdf-poster/trunk/freemius/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/wp-meta-and-date-remover/tags/2.3.4/freemius/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/provider/freemius/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/freemius/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/changeset/3235286/
- https://plugins.trac.wordpress.org/changeset/3249130/
- https://plugins.trac.wordpress.org/changeset/3229060/
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.