Skip to content
CVE PROGRAM SOURCE RECORD6.1 Medium

CVE-2024-13362

Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Wordfence

Description

Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

sebet Go Fetch Jobs (for WP Job Manager)

Default version status: unaffected

  • 0 to ≤ 1.8.4.8.1affected

5starplugins Dynamic Copyright Year

Default version status: unaffected

  • 0 to ≤ 1.0.4affected

peterschulznl Code Manager

Default version status: unaffected

  • 0 to ≤ 1.0.40affected

bplugins Advanced Scrollbar – Custom Scrollbar Styling and Behavior

Default version status: unaffected

  • 0 to ≤ 1.1.3affected

yuvalo Goal Tracker – Custom Event Tracking for GA4

Default version status: unaffected

  • 0 to ≤ 1.1.5affected

essekia Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent

Default version status: unaffected

  • 0 to ≤ 1.1.13affected

josevega WP Page Templates

Default version status: unaffected

  • 0 to ≤ 1.1.16affected

hkdigitalagency Payment Gateway for ACBA BANK

Default version status: unaffected

  • 0 to ≤ 1.2.6affected

princeahmed Dracula Dark Mode – Accessibility, Reading Mode & Dark Mode for WordPress

Default version status: unaffected

  • 0 to ≤ 1.2.7affected

spiderdevs Forumax – AI Powered Advanced Community Forum Plugin

Default version status: unaffected

  • 0 to ≤ 1.2.7affected

seezee Five-Star Ratings Shortcode

Default version status: unaffected

  • 0 to ≤ 1.2.56affected

oxilab Product Layouts for WooCommerce

Default version status: unaffected

  • 0 to ≤ 1.3.1affected

mr2p Meta Field Block – Display custom fields in the Block Editor without coding

Default version status: unaffected

  • 0 to ≤ 1.3.3affected

themelocation Custom WooCommerce Checkout Fields Editor

Default version status: unaffected

  • 0 to ≤ 1.3.4affected

100plugins Open User Map

Default version status: unaffected

  • 0 to ≤ 1.4.0affected

wpdever WP Notification Bell

Default version status: unaffected

  • 0 to ≤ 1.4.2affected

themelocation Remove Add to Cart WooCommerce

Default version status: unaffected

  • 0 to ≤ 1.4.7affected

princeahmed File Manager for Google Drive – Integrate Google Drive

Default version status: unaffected

  • 0 to ≤ 1.4.9affected

5starplugins Marijuana Age Verify

Default version status: unaffected

  • 0 to ≤ 1.5.5affected

infosatech RevivePress – Keep your Old Content Evergreen

Default version status: unaffected

  • 0 to ≤ 1.5.8affected

nicheaddons Restaurant & Cafe Addon for Elementor

Default version status: unaffected

  • 0 to ≤ 1.5.8affected

paretodigital Send Users Email – Email Subscribers, Email Marketing Newsletter

Default version status: unaffected

  • 0 to ≤ 1.5.10affected

unitecms Unlimited Elements For Elementor

Default version status: unaffected

  • 0 to ≤ 1.5.140affected

meowcrew Role Based Pricing for Woo by Meow Crew

Default version status: unaffected

  • 0 to ≤ 1.6.0affected

nicheaddons Primary Addon for Elementor

Default version status: unaffected

  • 0 to ≤ 1.6.0affected

5starplugins Featured Images in RSS for Mailchimp & More

Default version status: unaffected

  • 0 to ≤ 1.6.3affected

wpsaad Image Alt Text Manager – Bulk & Dynamic Alt Tags For image SEO Optimization + AI

Default version status: unaffected

  • 0 to ≤ 1.6.3affected

kofimokome Message Filter for Contact Form 7

Default version status: unaffected

  • 0 to ≤ 1.6.3.2affected

paretodigital Embedder for Google Reviews

Default version status: unaffected

  • 0 to ≤ 1.6.6affected

interactivegeomaps MapGeo – Interactive Geo Maps

Default version status: unaffected

  • 0 to ≤ 1.6.22affected

wpbits WPBITS Addons For Elementor Page Builder

Default version status: unaffected

  • 0 to ≤ 1.7affected

toddhalfpenny Widgets on Pages

Default version status: unaffected

  • 0 to ≤ 1.7affected

rebelcode Spotlight Social Feeds – Block, Shortcode, and Widget

Default version status: unaffected

  • 0 to ≤ 1.7.0affected

tobias_conrad WOW Styler for CF7 – Visual Styler for Contact Form 7 Forms

Default version status: unaffected

  • 0 to ≤ 1.7.0affected

webfactory AI Bud – AI Content Generator, AI Chatbot, ChatGPT, Gemini, GPT-4o

Default version status: unaffected

  • 0 to ≤ 1.7.2affected

hasanazizul Text To Speech TTS Accessibility

Default version status: unaffected

  • 0 to ≤ 1.7.34affected

5starplugins Easy Age Verify

Default version status: unaffected

  • 0 to ≤ 1.8.5affected

senols AI Puffer – Chat. Create. Automate. (formerly AI Power)

Default version status: unaffected

  • 0 to ≤ 1.8.99affected

damian-gora Justified Gallery

Default version status: unaffected

  • 0 to ≤ 1.9.0affected

mapster Mapster WP Maps

Default version status: unaffected

  • 0 to ≤ 1.9.0affected

streamweasels StreamWeasels Twitch Integration

Default version status: unaffected

  • 0 to ≤ 1.9.2affected

xplodedthemes XT Variation Swatches for WooCommerce

Default version status: unaffected

  • 0 to ≤ 1.9.4affected

bplugins bBlocks – Essential Gutenberg Blocks & Patterns Collection

Default version status: unaffected

  • 0 to ≤ 1.9.8affected

kaizencoders URL Shortify – Simple and Easy URL Shortener

Default version status: unaffected

  • 0 to ≤ 1.10.4affected

uriahs-victor Kikote – Location Picker at Checkout & Google Address AutoFill Plugin for WooCommerce

Default version status: unaffected

  • 0 to ≤ 1.10.6affected

cyberhobo Geo Mashup

Default version status: unaffected

  • 0 to ≤ 1.13.15affected

josevega Disable Payment Methods based on cart conditions for WooCommerce

Default version status: unaffected

  • 0 to ≤ 1.16.3affected

pagup Automatic Internal Links for SEO by Pagup

Default version status: unaffected

  • 0 to ≤ 2.0.0affected

enweby Full Screen Background

Default version status: unaffected

  • 0 to ≤ 2.0.2affected

litonice13 Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits

Default version status: unaffected

  • 0 to ≤ 2.0.7.2affected

princeahmed Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player

Default version status: unaffected

  • 0 to ≤ 2.0.82affected

spicethemes Carousel, Recent Post Slider and Banner Slider

Default version status: unaffected

  • 0 to ≤ 2.1affected

pagup Bulk Auto Image Alt Text (Alt tag, Alt attribute) optimizer (image SEO)

Default version status: unaffected

  • 0 to ≤ 2.1.0affected

xplodedthemes XT Quick View for WooCommerce

Default version status: unaffected

  • 0 to ≤ 2.1.5affected

pluginscafe Smart phone field for Gravity Forms

Default version status: unaffected

  • 0 to ≤ 2.1.6affected

fooplugins Notification Bar, Announcement and Cookie Notice WordPress Plugin – FooBar

Default version status: unaffected

  • 0 to ≤ 2.1.34affected

bplugins PDF Poster – Display PDF Files with Custom Viewer

Default version status: unaffected

  • 0 to ≤ 2.2.0affected

nicheaddons Events Addon for Elementor

Default version status: unaffected

  • 0 to ≤ 2.2.2affected

bplugins HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player

Default version status: unaffected

  • 0 to ≤ 2.2.27affected

mte90 Glossary

Default version status: unaffected

  • 0 to ≤ 2.2.38affected

tickera Restrict – membership, site, content and user access restrictions for WordPress

Default version status: unaffected

  • 0 to ≤ 2.3.0affected

cyclonecode Custom PHP Settings

Default version status: unaffected

  • 0 to ≤ 2.3.1affected

prasadkirpekar WP Meta and Date Remover

Default version status: unaffected

  • 0 to ≤ 2.3.4affected

fullworks Anti-Spam Protection – No API Key, GDPR Friendly

Default version status: unaffected

  • 0 to ≤ 2.3.7affected

premmerce Premmerce Permalink Manager for WooCommerce

Default version status: unaffected

  • 0 to ≤ 2.3.11affected

smartwpress Music Player for Elementor – Audio Player & Podcast Player

Default version status: unaffected

  • 0 to ≤ 2.4.1affected

mhmrajib TopNewsWp – Display Tikcer News, RSS Feed Widget and Many More

Default version status: unaffected

  • 0 to ≤ 2.4.1affected

oceanwp Ocean Extra

Default version status: unaffected

  • 0 to ≤ 2.4.2affected

fooplugins Gallery by FooGallery

Default version status: unaffected

  • 0 to ≤ 2.4.27affected

plugins360 Automatic YouTube Gallery

Default version status: unaffected

  • 0 to ≤ 2.5.5affected

spiderdevs EazyDocs – AI Powered Knowledge Base, Wiki, Documentation & FAQ Builder

Default version status: unaffected

  • 0 to ≤ 2.5.7affected

samdani Team Members – A WordPress Team Plugin with Gallery, Grid, Carousel, Slider, Table, List, and More

Default version status: unaffected

  • 0 to ≤ 2.5.8affected

tonyzeoli Radio Station by netmix® – Manage and play your Show Schedule in WordPress!

Default version status: unaffected

  • 0 to ≤ 2.5.9affected

kaira StoreCustomizer – A plugin to Customize all WooCommerce Pages

Default version status: unaffected

  • 0 to ≤ 2.5.9affected

wpjoli Joli Table Of Contents

Default version status: unaffected

  • 0 to ≤ 2.6.0affected

passionatebrains GA4WP – Analytics Dashboard for the Website

Default version status: unaffected

  • 0 to ≤ 2.6.0affected

nitin247 Place Order Without Payment for WooCommerce

Default version status: unaffected

  • 0 to ≤ 2.6.5affected

wordplus Better Messages – Live Chat, Chat Rooms, Real-Time Messaging & Private Messages

Default version status: unaffected

  • 0 to ≤ 2.6.7affected

mihail-barinov Share This Image

Default version status: unaffected

  • 0 to ≤ 2.07affected

inavii Inavii Social Feed

Default version status: unaffected

  • 0 to ≤ 2.7.0affected

fooplugins Lightbox & Modal Popup WordPress Plugin – FooBox

Default version status: unaffected

  • 0 to ≤ 2.7.33affected

xplodedthemes XT Floating Cart for WooCommerce

Default version status: unaffected

  • 0 to ≤ 2.8.4affected

takanakui WP Mobile Menu – The Mobile-Friendly Responsive Menu

Default version status: unaffected

  • 0 to ≤ 2.8.6affected

passionatebrains AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading & Image Optimization

Default version status: unaffected

  • 0 to ≤ 2.9.2affected

bensibley Independent Analytics

Default version status: unaffected

  • 0 to ≤ 2.9.7affected

codesavory Knowledge Base documentation & wiki plugin – BasePress Docs

Default version status: unaffected

  • 0 to ≤ 2.16.3.3affected

davidanderson Internal Link Juicer: SEO Auto Linker for WordPress

Default version status: unaffected

  • 0 to ≤ 2.24.6affected

josevega Bulk Edit Posts and Products in Spreadsheet

Default version status: unaffected

  • 0 to ≤ 2.25.16affected

saadiqbal Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App

Default version status: unaffected

  • 0 to ≤ 3.0.0affected

tobiasbg TablePress – Tables in WordPress made easy

Default version status: unaffected

  • 0 to ≤ 3.0.2affected

bouncingsprout Ultimeter

Default version status: unaffected

  • 0 to ≤ 3.0.5affected

blackandwhitedigital TreePress – Easy Family Trees & Ancestor Profiles

Default version status: unaffected

  • 0 to ≤ 3.0.6affected

mattpramschufer Pay For Post with WooCommerce

Default version status: unaffected

  • 0 to ≤ 3.1.26affected

koen12344 Post to Google My Business (Google Business Profile)

Default version status: unaffected

  • 0 to ≤ 3.1.28affected

imtiazrayhan WP Coupons and Deals – Coupon Plugin For Affiliate Marketers

Default version status: unaffected

  • 0 to ≤ 3.2.2affected

pluginsware Advanced Classifieds & Directory Pro

Default version status: unaffected

  • 0 to ≤ 3.2.4affected

gallerycreator Mixed Media Gallery Blocks

Default version status: unaffected

  • 0 to ≤ 3.2.4.4affected

blockspare BlockSpare — News, Magazine and Blog Addons for (Gutenberg) Block Editor

Default version status: unaffected

  • 0 to ≤ 3.2.6affected

mhmrajib AidWP – Donation & Payment Forms (Stripe Powered)

Default version status: unaffected

  • 0 to ≤ 3.2.6affected

infornweb Logo Showcase – Responsive Logo Carousel, Logo Slider & Logo Grid

Default version status: unaffected

  • 0 to ≤ 3.2.7affected

pluginandplay Post Slider and Post Carousel with Post Vertical Scrolling Widget – A Responsive Post Slider

Default version status: unaffected

  • 0 to ≤ 3.2.7affected

samdani Solid Testimonials – Testimonial Slider, Video Testimonials & Customer Reviews

Default version status: unaffected

  • 0 to ≤ 3.2.8affected

wpspeedo Team Members Showcase

Default version status: unaffected

  • 0 to ≤ 3.3.0affected

elespare EleSpare – News, Magazine and Blog Addons for Elementor

Default version status: unaffected

  • 0 to ≤ 3.3.2affected

infornweb Post List Designer – Category Post, Recent Post, Post List

Default version status: unaffected

  • 0 to ≤ 3.3.7affected

infornweb Blog Designer Pack – Blog, Post Grid, Post Slider, Post Carousel, Category Post, News

Default version status: unaffected

  • 0 to ≤ 3.4.9affected

dashlabsltd YASR – Yet Another Star Rating Plugin for WordPress

Default version status: unaffected

  • 0 to ≤ 3.4.12affected

xplodedthemes WPIDE – File Manager & Code Editor

Default version status: unaffected

  • 0 to ≤ 3.5.1affected

premmerce Premmerce Product Filter for WooCommerce

Default version status: unaffected

  • 0 to ≤ 3.7.3affected

afthemes WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars

Default version status: unaffected

  • 0 to ≤ 3.8.3affected

wpmagics Delete Posts automatically

Default version status: unaffected

  • 0 to ≤ 3.9.6affected

takanakui Menu Image, Icons made easy

Default version status: unaffected

  • 0 to ≤ 3.12affected

passionatebrains AWCA – The Great Analytics Insights for Your eStore

Default version status: unaffected

  • 0 to ≤ 3.12.0affected

mikewire_rocksolid Announcement & Notification Banner – Bulletin

Default version status: unaffected

  • 0 to ≤ 3.12.1affected

nitin247 Thank You Page for WooCommerce

Default version status: unaffected

  • 0 to ≤ 4.2.0affected

webheadllc Contact Form 7 Multi-Step Forms

Default version status: unaffected

  • 0 to ≤ 4.4.1affected

speedify Auto-Install Free SSL – Generate & Install Free SSL Certificates

Default version status: unaffected

  • 0 to ≤ 4.5.0affected

mhmrajib WP Books Gallery – Build Stunning Book Showcases & Libraries in Minutes

Default version status: unaffected

  • 0 to ≤ 4.6.8affected

webba-agency Easy Appointment Booking & Scheduling System – Webba Booking Calendar

Default version status: unaffected

  • 0 to ≤ 5.0.57affected

invisnet WP fail2ban – Advanced Security

Default version status: unaffected

  • 0 to ≤ 5.3.4affected

vinod-dalvi Ivory Search – WordPress Search Plugin

Default version status: unaffected

  • 0 to ≤ 5.5.8affected

peterschulznl WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards

Default version status: unaffected

  • 0 to ≤ 5.5.31affected

elliotvs Coupon Affiliates – Affiliate Plugin for WooCommerce

Default version status: unaffected

  • 0 to ≤ 5.17.2affected

cleverplugins Security Ninja – WordPress Security & Firewall

Default version status: unaffected

  • 0 to ≤ 5.222affected

theafricanboss Checkout with Cash App on WooCommerce

Default version status: unaffected

  • 0 to ≤ 6.0.2affected

fullworks Display Eventbrite Events

Default version status: unaffected

  • 0 to ≤ 6.1.10affected

mohsinoffline Secure Gateway for Authorize.net and WooCommerce by Pledged Plugins

Default version status: unaffected

  • 0 to ≤ 6.1.13affected

sjaved Easy Social Feed – Social Photos Gallery and Post Feed for WordPress

Default version status: unaffected

  • 0 to ≤ 6.6.5affected

gn_themes WP Shortcodes Plugin — Shortcodes Ultimate

Default version status: unaffected

  • 0 to ≤ 7.3.3affected

gowebsmarty WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan

Default version status: unaffected

  • 0 to ≤ 7.7.0affected

tripetto WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto

Default version status: unaffected

  • 0 to ≤ 8.0.7affected

References