目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CVE-2024-13362— WordPress多款产品 跨站脚本漏洞

一分钟漏洞结论

影响对象
sebet Go Fetch Jobs (for WP Job Manager)
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。

WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台具有在基于PHP和MySQL的服务器上架设个人博客网站的功能。WordPress plugin是一个应用插件。 WordPress多款产品存在跨站脚本漏洞，该漏洞源于输入清理和输出转义不足，可能导致反射型跨站脚本攻击。以下产品受到影响：WordPress plugin AI Bud、WordPress plugin AEH Speed Optimization

CVSS 6.1 · Medium EPSS 0.28% · P19

影响版本矩阵 131

厂商产品 版本范围状态
100plugins Open User Map ≤ 1.4.0 affected
5starplugins Dynamic Copyright Year ≤ 1.0.4 affected
5starplugins Easy Age Verify ≤ 1.8.5 affected
5starplugins Featured Images in RSS for Mailchimp & More ≤ 1.6.3 affected
5starplugins Marijuana Age Verify ≤ 1.5.5 affected
afthemes WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars ≤ 3.8.3 affected
bensibley Independent Analytics ≤ 2.9.7 affected
blackandwhitedigital TreePress – Easy Family Trees & Ancestor Profiles ≤ 3.0.6 affected
blockspare BlockSpare — News, Magazine and Blog Addons for (Gutenberg) Block Editor ≤ 3.2.6 affected
bouncingsprout Ultimeter ≤ 3.0.5 affected
bplugins Advanced Scrollbar – Custom Scrollbar Styling and Behavior ≤ 1.1.3 affected
bplugins bBlocks – Essential Gutenberg Blocks & Patterns Collection ≤ 1.9.8 affected
bplugins HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player ≤ 2.2.27 affected
bplugins PDF Poster – Display PDF Files with Custom Viewer ≤ 2.2.0 affected
cleverplugins Security Ninja – WordPress Security & Firewall ≤ 5.222 affected
codesavory Knowledge Base documentation & wiki plugin – BasePress Docs ≤ 2.16.3.3 affected
cyberhobo Geo Mashup ≤ 1.13.15 affected
cyclonecode Custom PHP Settings ≤ 2.3.1 affected
damian-gora Justified Gallery ≤ 1.9.0 affected
dashlabsltd YASR – Yet Another Star Rating Plugin for WordPress ≤ 3.4.12 affected
davidanderson Internal Link Juicer: SEO Auto Linker for WordPress ≤ 2.24.6 affected
elespare EleSpare – News, Magazine and Blog Addons for Elementor ≤ 3.3.2 affected
elliotvs Coupon Affiliates – Affiliate Plugin for WooCommerce ≤ 5.17.2 affected
enweby Full Screen Background ≤ 2.0.2 affected
essekia Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent ≤ 1.1.13 affected
fooplugins Gallery by FooGallery ≤ 2.4.27 affected
fooplugins Lightbox & Modal Popup WordPress Plugin – FooBox ≤ 2.7.33 affected
fooplugins Notification Bar, Announcement and Cookie Notice WordPress Plugin – FooBar ≤ 2.1.34 affected
fullworks Anti-Spam Protection – No API Key, GDPR Friendly ≤ 2.3.7 affected
fullworks Display Eventbrite Events ≤ 6.1.10 affected
gallerycreator Mixed Media Gallery Blocks ≤ 3.2.4.4 affected
gn_themes WP Shortcodes Plugin — Shortcodes Ultimate ≤ 7.3.3 affected
gowebsmarty WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan ≤ 7.7.0 affected
hasanazizul Text To Speech TTS Accessibility ≤ 1.7.34 affected
hkdigitalagency Payment Gateway for ACBA BANK ≤ 1.2.6 affected
imtiazrayhan WP Coupons and Deals – Coupon Plugin For Affiliate Marketers ≤ 3.2.2 affected
inavii Inavii Social Feed ≤ 2.7.0 affected
infornweb Blog Designer Pack – Blog, Post Grid, Post Slider, Post Carousel, Category Post, News ≤ 3.4.9 affected
infornweb Logo Showcase – Responsive Logo Carousel, Logo Slider & Logo Grid ≤ 3.2.7 affected
infornweb Post List Designer – Category Post, Recent Post, Post List ≤ 3.3.7 affected
infosatech RevivePress – Keep your Old Content Evergreen ≤ 1.5.8 affected
interactivegeomaps MapGeo – Interactive Geo Maps ≤ 1.6.22 affected
invisnet WP fail2ban – Advanced Security ≤ 5.3.4 affected
josevega Bulk Edit Posts and Products in Spreadsheet ≤ 2.25.16 affected
josevega Disable Payment Methods based on cart conditions for WooCommerce ≤ 1.16.3 affected
josevega WP Page Templates ≤ 1.1.16 affected
kaira StoreCustomizer – A plugin to Customize all WooCommerce Pages ≤ 2.5.9 affected
kaizencoders URL Shortify – Simple and Easy URL Shortener ≤ 1.10.4 affected
koen12344 Post to Google My Business (Google Business Profile) ≤ 3.1.28 affected
kofimokome Message Filter for Contact Form 7 ≤ 1.6.3.2 affected
litonice13 Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits ≤ 2.0.7.2 affected
mapster Mapster WP Maps ≤ 1.9.0 affected
mattpramschufer Pay For Post with WooCommerce ≤ 3.1.26 affected
meowcrew Role Based Pricing for Woo by Meow Crew ≤ 1.6.0 affected
mhmrajib AidWP – Donation & Payment Forms (Stripe Powered) ≤ 3.2.6 affected
mhmrajib TopNewsWp – Display Tikcer News, RSS Feed Widget and Many More ≤ 2.4.1 affected
mhmrajib WP Books Gallery – Build Stunning Book Showcases & Libraries in Minutes ≤ 4.6.8 affected
mihail-barinov Share This Image ≤ 2.07 affected
mikewire_rocksolid Announcement & Notification Banner – Bulletin ≤ 3.12.1 affected
mohsinoffline Secure Gateway for Authorize.net and WooCommerce by Pledged Plugins ≤ 6.1.13 affected
mr2p Meta Field Block – Display custom fields in the Block Editor without coding ≤ 1.3.3 affected
mte90 Glossary ≤ 2.2.38 affected
nicheaddons Events Addon for Elementor ≤ 2.2.2 affected
nicheaddons Primary Addon for Elementor ≤ 1.6.0 affected
nicheaddons Restaurant & Cafe Addon for Elementor ≤ 1.5.8 affected
nitin247 Place Order Without Payment for WooCommerce ≤ 2.6.5 affected
nitin247 Thank You Page for WooCommerce ≤ 4.2.0 affected
oceanwp Ocean Extra ≤ 2.4.2 affected
oxilab Product Layouts for WooCommerce ≤ 1.3.1 affected
pagup Automatic Internal Links for SEO by Pagup ≤ 2.0.0 affected
pagup Bulk Auto Image Alt Text (Alt tag, Alt attribute) optimizer (image SEO) ≤ 2.1.0 affected
paretodigital Embedder for Google Reviews ≤ 1.6.6 affected
paretodigital Send Users Email – Email Subscribers, Email Marketing Newsletter ≤ 1.5.10 affected
passionatebrains AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading & Image Optimization ≤ 2.9.2 affected
passionatebrains AWCA – The Great Analytics Insights for Your eStore ≤ 3.12.0 affected
passionatebrains GA4WP – Analytics Dashboard for the Website ≤ 2.6.0 affected
peterschulznl Code Manager ≤ 1.0.40 affected
peterschulznl WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards ≤ 5.5.31 affected
pluginandplay Post Slider and Post Carousel with Post Vertical Scrolling Widget – A Responsive Post Slider ≤ 3.2.7 affected
plugins360 Automatic YouTube Gallery ≤ 2.5.5 affected
pluginscafe Smart phone field for Gravity Forms ≤ 2.1.6 affected
pluginsware Advanced Classifieds & Directory Pro ≤ 3.2.4 affected
prasadkirpekar WP Meta and Date Remover ≤ 2.3.4 affected
premmerce Premmerce Permalink Manager for WooCommerce ≤ 2.3.11 affected
premmerce Premmerce Product Filter for WooCommerce ≤ 3.7.3 affected
princeahmed Dracula Dark Mode – Accessibility, Reading Mode & Dark Mode for WordPress ≤ 1.2.7 affected
princeahmed File Manager for Google Drive – Integrate Google Drive ≤ 1.4.9 affected
princeahmed Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player ≤ 2.0.82 affected
rebelcode Spotlight Social Feeds – Block, Shortcode, and Widget ≤ 1.7.0 affected
saadiqbal Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App ≤ 3.0.0 affected
samdani Solid Testimonials – Testimonial Slider, Video Testimonials & Customer Reviews ≤ 3.2.8 affected
samdani Team Members – A WordPress Team Plugin with Gallery, Grid, Carousel, Slider, Table, List, and More ≤ 2.5.8 affected
sebet Go Fetch Jobs (for WP Job Manager) ≤ 1.8.4.8.1 affected
seezee Five-Star Ratings Shortcode ≤ 1.2.56 affected
senols AI Puffer – Chat. Create. Automate. (formerly AI Power) ≤ 1.8.99 affected
sjaved Easy Social Feed – Social Photos Gallery and Post Feed for WordPress ≤ 6.6.5 affected
smartwpress Music Player for Elementor – Audio Player & Podcast Player ≤ 2.4.1 affected
speedify Auto-Install Free SSL – Generate & Install Free SSL Certificates ≤ 4.5.0 affected
spicethemes Carousel, Recent Post Slider and Banner Slider ≤ 2.1 affected
spiderdevs EazyDocs – AI Powered Knowledge Base, Wiki, Documentation & FAQ Builder ≤ 2.5.7 affected
spiderdevs Forumax – AI Powered Advanced Community Forum Plugin ≤ 1.2.7 affected
streamweasels StreamWeasels Twitch Integration ≤ 1.9.2 affected
takanakui Menu Image, Icons made easy ≤ 3.12 affected
takanakui WP Mobile Menu – The Mobile-Friendly Responsive Menu ≤ 2.8.6 affected
theafricanboss Checkout with Cash App on WooCommerce ≤ 6.0.2 affected
themelocation Custom WooCommerce Checkout Fields Editor ≤ 1.3.4 affected
themelocation Remove Add to Cart WooCommerce ≤ 1.4.7 affected
tickera Restrict – membership, site, content and user access restrictions for WordPress ≤ 2.3.0 affected
tobias_conrad WOW Styler for CF7 – Visual Styler for Contact Form 7 Forms ≤ 1.7.0 affected
tobiasbg TablePress – Tables in WordPress made easy ≤ 3.0.2 affected
toddhalfpenny Widgets on Pages ≤ 1.7 affected
tonyzeoli Radio Station by netmix® – Manage and play your Show Schedule in WordPress! ≤ 2.5.9 affected
tripetto WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto ≤ 8.0.7 affected
unitecms Unlimited Elements For Elementor ≤ 1.5.140 affected
uriahs-victor Kikote – Location Picker at Checkout & Google Address AutoFill Plugin for WooCommerce ≤ 1.10.6 affected
vinod-dalvi Ivory Search – WordPress Search Plugin ≤ 5.5.8 affected
webba-agency Easy Appointment Booking & Scheduling System – Webba Booking Calendar ≤ 5.0.57 affected
webfactory AI Bud – AI Content Generator, AI Chatbot, ChatGPT, Gemini, GPT-4o ≤ 1.7.2 affected
webheadllc Contact Form 7 Multi-Step Forms ≤ 4.4.1 affected
wordplus Better Messages – Live Chat, Chat Rooms, Real-Time Messaging & Private Messages ≤ 2.6.7 affected
wpbits WPBITS Addons For Elementor Page Builder ≤ 1.7 affected
wpdever WP Notification Bell ≤ 1.4.2 affected
wpjoli Joli Table Of Contents ≤ 2.6.0 affected
wpmagics Delete Posts automatically ≤ 3.9.6 affected
wpsaad Image Alt Text Manager – Bulk & Dynamic Alt Tags For image SEO Optimization + AI ≤ 1.6.3 affected
wpspeedo Team Members Showcase ≤ 3.3.0 affected
xplodedthemes WPIDE – File Manager & Code Editor ≤ 3.5.1 affected
xplodedthemes XT Floating Cart for WooCommerce ≤ 2.8.4 affected
xplodedthemes XT Quick View for WooCommerce ≤ 2.1.5 affected
xplodedthemes XT Variation Swatches for WooCommerce ≤ 1.9.4 affected
yuvalo Goal Tracker – Custom Event Tracking for GA4 ≤ 1.1.5 affected
获取后续新漏洞提醒 登录后订阅

一、 漏洞 CVE-2024-13362 基础信息

漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗

尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。

Vulnerability Title
Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
来源: CVE Program / CVE List V5
Vulnerability Description
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
来源: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
来源: CVE Program / CVE List V5
Vulnerability Title
WordPress多款产品 跨站脚本漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台具有在基于PHP和MySQL的服务器上架设个人博客网站的功能。WordPress plugin是一个应用插件。 WordPress多款产品存在跨站脚本漏洞，该漏洞源于输入清理和输出转义不足，可能导致反射型跨站脚本攻击。以下产品受到影响：WordPress plugin AI Bud、WordPress plugin AEH Speed Optimization
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD

受影响产品

厂商 产品 影响版本 CPE 订阅
sebet Go Fetch Jobs (for WP Job Manager) 0 ~ 1.8.4.8.1 -
5starplugins Dynamic Copyright Year 0 ~ 1.0.4 -
peterschulznl Code Manager 0 ~ 1.0.40 -
bplugins Advanced Scrollbar – Custom Scrollbar Styling and Behavior 0 ~ 1.1.3 -
yuvalo Goal Tracker – Custom Event Tracking for GA4 0 ~ 1.1.5 -
essekia Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent 0 ~ 1.1.13 -
josevega WP Page Templates 0 ~ 1.1.16 -
hkdigitalagency Payment Gateway for ACBA BANK 0 ~ 1.2.6 -
princeahmed Dracula Dark Mode – Accessibility, Reading Mode & Dark Mode for WordPress 0 ~ 1.2.7 -
spiderdevs Forumax – AI Powered Advanced Community Forum Plugin 0 ~ 1.2.7 -
seezee Five-Star Ratings Shortcode 0 ~ 1.2.56 -
oxilab Product Layouts for WooCommerce 0 ~ 1.3.1 -
mr2p Meta Field Block – Display custom fields in the Block Editor without coding 0 ~ 1.3.3 -
themelocation Custom WooCommerce Checkout Fields Editor 0 ~ 1.3.4 -
100plugins Open User Map 0 ~ 1.4.0 -
wpdever WP Notification Bell 0 ~ 1.4.2 -
themelocation Remove Add to Cart WooCommerce 0 ~ 1.4.7 -
princeahmed File Manager for Google Drive – Integrate Google Drive 0 ~ 1.4.9 -
5starplugins Marijuana Age Verify 0 ~ 1.5.5 -
infosatech RevivePress – Keep your Old Content Evergreen 0 ~ 1.5.8 -
nicheaddons Restaurant & Cafe Addon for Elementor 0 ~ 1.5.8 -
paretodigital Send Users Email – Email Subscribers, Email Marketing Newsletter 0 ~ 1.5.10 -
unitecms Unlimited Elements For Elementor 0 ~ 1.5.140 -
meowcrew Role Based Pricing for Woo by Meow Crew 0 ~ 1.6.0 -
nicheaddons Primary Addon for Elementor 0 ~ 1.6.0 -
5starplugins Featured Images in RSS for Mailchimp & More 0 ~ 1.6.3 -
wpsaad Image Alt Text Manager – Bulk & Dynamic Alt Tags For image SEO Optimization + AI 0 ~ 1.6.3 -
kofimokome Message Filter for Contact Form 7 0 ~ 1.6.3.2 -
paretodigital Embedder for Google Reviews 0 ~ 1.6.6 -
interactivegeomaps MapGeo – Interactive Geo Maps 0 ~ 1.6.22 -

二、漏洞 CVE-2024-13362 的公开POC

# POC 描述 源链接 神龙链接
AI 生成 POC 高级

未找到公开 POC。

登录以生成 AI POC

三、漏洞 CVE-2024-13362 的情报信息

请登录查看更多情报信息。

CVE-2024-13362 补丁与修复 (2)

CVE-2024-13362 厂商安全公告 (1)

IV. Related Vulnerabilities

Same weakness: CWE-79

V. Comments for CVE-2024-13362

暂无评论

发表评论