Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-13362— Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter

Quick assessment

Affected
sebet Go Fetch Jobs (for WP Job Manager)
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台具有在基于PHP和MySQL的服务器上架设个人博客网站的功能。WordPress plugin是一个应用插件。 WordPress多款产品存在跨站脚本漏洞，该漏洞源于输入清理和输出转义不足，可能导致反射型跨站脚本攻击。以下产品受到影响：WordPress plugin AI Bud、WordPress plugin AEH Speed Optimization

CVSS 6.1 · Medium EPSS 0.28% · P19

Affected Version Matrix 131

VendorProduct Version RangeStatus
100plugins Open User Map ≤ 1.4.0 affected
5starplugins Dynamic Copyright Year ≤ 1.0.4 affected
5starplugins Easy Age Verify ≤ 1.8.5 affected
5starplugins Featured Images in RSS for Mailchimp & More ≤ 1.6.3 affected
5starplugins Marijuana Age Verify ≤ 1.5.5 affected
afthemes WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars ≤ 3.8.3 affected
bensibley Independent Analytics ≤ 2.9.7 affected
blackandwhitedigital TreePress – Easy Family Trees & Ancestor Profiles ≤ 3.0.6 affected
blockspare BlockSpare — News, Magazine and Blog Addons for (Gutenberg) Block Editor ≤ 3.2.6 affected
bouncingsprout Ultimeter ≤ 3.0.5 affected
bplugins Advanced Scrollbar – Custom Scrollbar Styling and Behavior ≤ 1.1.3 affected
bplugins bBlocks – Essential Gutenberg Blocks & Patterns Collection ≤ 1.9.8 affected
bplugins HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player ≤ 2.2.27 affected
bplugins PDF Poster – Display PDF Files with Custom Viewer ≤ 2.2.0 affected
cleverplugins Security Ninja – WordPress Security & Firewall ≤ 5.222 affected
codesavory Knowledge Base documentation & wiki plugin – BasePress Docs ≤ 2.16.3.3 affected
cyberhobo Geo Mashup ≤ 1.13.15 affected
cyclonecode Custom PHP Settings ≤ 2.3.1 affected
damian-gora Justified Gallery ≤ 1.9.0 affected
dashlabsltd YASR – Yet Another Star Rating Plugin for WordPress ≤ 3.4.12 affected
davidanderson Internal Link Juicer: SEO Auto Linker for WordPress ≤ 2.24.6 affected
elespare EleSpare – News, Magazine and Blog Addons for Elementor ≤ 3.3.2 affected
elliotvs Coupon Affiliates – Affiliate Plugin for WooCommerce ≤ 5.17.2 affected
enweby Full Screen Background ≤ 2.0.2 affected
essekia Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent ≤ 1.1.13 affected
fooplugins Gallery by FooGallery ≤ 2.4.27 affected
fooplugins Lightbox & Modal Popup WordPress Plugin – FooBox ≤ 2.7.33 affected
fooplugins Notification Bar, Announcement and Cookie Notice WordPress Plugin – FooBar ≤ 2.1.34 affected
fullworks Anti-Spam Protection – No API Key, GDPR Friendly ≤ 2.3.7 affected
fullworks Display Eventbrite Events ≤ 6.1.10 affected
gallerycreator Mixed Media Gallery Blocks ≤ 3.2.4.4 affected
gn_themes WP Shortcodes Plugin — Shortcodes Ultimate ≤ 7.3.3 affected
gowebsmarty WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan ≤ 7.7.0 affected
hasanazizul Text To Speech TTS Accessibility ≤ 1.7.34 affected
hkdigitalagency Payment Gateway for ACBA BANK ≤ 1.2.6 affected
imtiazrayhan WP Coupons and Deals – Coupon Plugin For Affiliate Marketers ≤ 3.2.2 affected
inavii Inavii Social Feed ≤ 2.7.0 affected
infornweb Blog Designer Pack – Blog, Post Grid, Post Slider, Post Carousel, Category Post, News ≤ 3.4.9 affected
infornweb Logo Showcase – Responsive Logo Carousel, Logo Slider & Logo Grid ≤ 3.2.7 affected
infornweb Post List Designer – Category Post, Recent Post, Post List ≤ 3.3.7 affected
infosatech RevivePress – Keep your Old Content Evergreen ≤ 1.5.8 affected
interactivegeomaps MapGeo – Interactive Geo Maps ≤ 1.6.22 affected
invisnet WP fail2ban – Advanced Security ≤ 5.3.4 affected
josevega Bulk Edit Posts and Products in Spreadsheet ≤ 2.25.16 affected
josevega Disable Payment Methods based on cart conditions for WooCommerce ≤ 1.16.3 affected
josevega WP Page Templates ≤ 1.1.16 affected
kaira StoreCustomizer – A plugin to Customize all WooCommerce Pages ≤ 2.5.9 affected
kaizencoders URL Shortify – Simple and Easy URL Shortener ≤ 1.10.4 affected
koen12344 Post to Google My Business (Google Business Profile) ≤ 3.1.28 affected
kofimokome Message Filter for Contact Form 7 ≤ 1.6.3.2 affected
litonice13 Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits ≤ 2.0.7.2 affected
mapster Mapster WP Maps ≤ 1.9.0 affected
mattpramschufer Pay For Post with WooCommerce ≤ 3.1.26 affected
meowcrew Role Based Pricing for Woo by Meow Crew ≤ 1.6.0 affected
mhmrajib AidWP – Donation & Payment Forms (Stripe Powered) ≤ 3.2.6 affected
mhmrajib TopNewsWp – Display Tikcer News, RSS Feed Widget and Many More ≤ 2.4.1 affected
mhmrajib WP Books Gallery – Build Stunning Book Showcases & Libraries in Minutes ≤ 4.6.8 affected
mihail-barinov Share This Image ≤ 2.07 affected
mikewire_rocksolid Announcement & Notification Banner – Bulletin ≤ 3.12.1 affected
mohsinoffline Secure Gateway for Authorize.net and WooCommerce by Pledged Plugins ≤ 6.1.13 affected
mr2p Meta Field Block – Display custom fields in the Block Editor without coding ≤ 1.3.3 affected
mte90 Glossary ≤ 2.2.38 affected
nicheaddons Events Addon for Elementor ≤ 2.2.2 affected
nicheaddons Primary Addon for Elementor ≤ 1.6.0 affected
nicheaddons Restaurant & Cafe Addon for Elementor ≤ 1.5.8 affected
nitin247 Place Order Without Payment for WooCommerce ≤ 2.6.5 affected
nitin247 Thank You Page for WooCommerce ≤ 4.2.0 affected
oceanwp Ocean Extra ≤ 2.4.2 affected
oxilab Product Layouts for WooCommerce ≤ 1.3.1 affected
pagup Automatic Internal Links for SEO by Pagup ≤ 2.0.0 affected
pagup Bulk Auto Image Alt Text (Alt tag, Alt attribute) optimizer (image SEO) ≤ 2.1.0 affected
paretodigital Embedder for Google Reviews ≤ 1.6.6 affected
paretodigital Send Users Email – Email Subscribers, Email Marketing Newsletter ≤ 1.5.10 affected
passionatebrains AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading & Image Optimization ≤ 2.9.2 affected
passionatebrains AWCA – The Great Analytics Insights for Your eStore ≤ 3.12.0 affected
passionatebrains GA4WP – Analytics Dashboard for the Website ≤ 2.6.0 affected
peterschulznl Code Manager ≤ 1.0.40 affected
peterschulznl WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards ≤ 5.5.31 affected
pluginandplay Post Slider and Post Carousel with Post Vertical Scrolling Widget – A Responsive Post Slider ≤ 3.2.7 affected
plugins360 Automatic YouTube Gallery ≤ 2.5.5 affected
pluginscafe Smart phone field for Gravity Forms ≤ 2.1.6 affected
pluginsware Advanced Classifieds & Directory Pro ≤ 3.2.4 affected
prasadkirpekar WP Meta and Date Remover ≤ 2.3.4 affected
premmerce Premmerce Permalink Manager for WooCommerce ≤ 2.3.11 affected
premmerce Premmerce Product Filter for WooCommerce ≤ 3.7.3 affected
princeahmed Dracula Dark Mode – Accessibility, Reading Mode & Dark Mode for WordPress ≤ 1.2.7 affected
princeahmed File Manager for Google Drive – Integrate Google Drive ≤ 1.4.9 affected
princeahmed Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player ≤ 2.0.82 affected
rebelcode Spotlight Social Feeds – Block, Shortcode, and Widget ≤ 1.7.0 affected
saadiqbal Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App ≤ 3.0.0 affected
samdani Solid Testimonials – Testimonial Slider, Video Testimonials & Customer Reviews ≤ 3.2.8 affected
samdani Team Members – A WordPress Team Plugin with Gallery, Grid, Carousel, Slider, Table, List, and More ≤ 2.5.8 affected
sebet Go Fetch Jobs (for WP Job Manager) ≤ 1.8.4.8.1 affected
seezee Five-Star Ratings Shortcode ≤ 1.2.56 affected
senols AI Puffer – Chat. Create. Automate. (formerly AI Power) ≤ 1.8.99 affected
sjaved Easy Social Feed – Social Photos Gallery and Post Feed for WordPress ≤ 6.6.5 affected
smartwpress Music Player for Elementor – Audio Player & Podcast Player ≤ 2.4.1 affected
speedify Auto-Install Free SSL – Generate & Install Free SSL Certificates ≤ 4.5.0 affected
spicethemes Carousel, Recent Post Slider and Banner Slider ≤ 2.1 affected
spiderdevs EazyDocs – AI Powered Knowledge Base, Wiki, Documentation & FAQ Builder ≤ 2.5.7 affected
spiderdevs Forumax – AI Powered Advanced Community Forum Plugin ≤ 1.2.7 affected
streamweasels StreamWeasels Twitch Integration ≤ 1.9.2 affected
takanakui Menu Image, Icons made easy ≤ 3.12 affected
takanakui WP Mobile Menu – The Mobile-Friendly Responsive Menu ≤ 2.8.6 affected
theafricanboss Checkout with Cash App on WooCommerce ≤ 6.0.2 affected
themelocation Custom WooCommerce Checkout Fields Editor ≤ 1.3.4 affected
themelocation Remove Add to Cart WooCommerce ≤ 1.4.7 affected
tickera Restrict – membership, site, content and user access restrictions for WordPress ≤ 2.3.0 affected
tobias_conrad WOW Styler for CF7 – Visual Styler for Contact Form 7 Forms ≤ 1.7.0 affected
tobiasbg TablePress – Tables in WordPress made easy ≤ 3.0.2 affected
toddhalfpenny Widgets on Pages ≤ 1.7 affected
tonyzeoli Radio Station by netmix® – Manage and play your Show Schedule in WordPress! ≤ 2.5.9 affected
tripetto WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto ≤ 8.0.7 affected
unitecms Unlimited Elements For Elementor ≤ 1.5.140 affected
uriahs-victor Kikote – Location Picker at Checkout & Google Address AutoFill Plugin for WooCommerce ≤ 1.10.6 affected
vinod-dalvi Ivory Search – WordPress Search Plugin ≤ 5.5.8 affected
webba-agency Easy Appointment Booking & Scheduling System – Webba Booking Calendar ≤ 5.0.57 affected
webfactory AI Bud – AI Content Generator, AI Chatbot, ChatGPT, Gemini, GPT-4o ≤ 1.7.2 affected
webheadllc Contact Form 7 Multi-Step Forms ≤ 4.4.1 affected
wordplus Better Messages – Live Chat, Chat Rooms, Real-Time Messaging & Private Messages ≤ 2.6.7 affected
wpbits WPBITS Addons For Elementor Page Builder ≤ 1.7 affected
wpdever WP Notification Bell ≤ 1.4.2 affected
wpjoli Joli Table Of Contents ≤ 2.6.0 affected
wpmagics Delete Posts automatically ≤ 3.9.6 affected
wpsaad Image Alt Text Manager – Bulk & Dynamic Alt Tags For image SEO Optimization + AI ≤ 1.6.3 affected
wpspeedo Team Members Showcase ≤ 3.3.0 affected
xplodedthemes WPIDE – File Manager & Code Editor ≤ 3.5.1 affected
xplodedthemes XT Floating Cart for WooCommerce ≤ 2.8.4 affected
xplodedthemes XT Quick View for WooCommerce ≤ 2.1.5 affected
xplodedthemes XT Variation Swatches for WooCommerce ≤ 1.9.4 affected
yuvalo Goal Tracker – Custom Event Tracking for GA4 ≤ 1.1.5 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-13362

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
Source: CVE Program / CVE List V5
Vulnerability Description
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress多款产品 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台具有在基于PHP和MySQL的服务器上架设个人博客网站的功能。WordPress plugin是一个应用插件。 WordPress多款产品存在跨站脚本漏洞，该漏洞源于输入清理和输出转义不足，可能导致反射型跨站脚本攻击。以下产品受到影响：WordPress plugin AI Bud、WordPress plugin AEH Speed Optimization
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
sebet Go Fetch Jobs (for WP Job Manager) 0 ~ 1.8.4.8.1 -
5starplugins Dynamic Copyright Year 0 ~ 1.0.4 -
peterschulznl Code Manager 0 ~ 1.0.40 -
bplugins Advanced Scrollbar – Custom Scrollbar Styling and Behavior 0 ~ 1.1.3 -
yuvalo Goal Tracker – Custom Event Tracking for GA4 0 ~ 1.1.5 -
essekia Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent 0 ~ 1.1.13 -
josevega WP Page Templates 0 ~ 1.1.16 -
hkdigitalagency Payment Gateway for ACBA BANK 0 ~ 1.2.6 -
princeahmed Dracula Dark Mode – Accessibility, Reading Mode & Dark Mode for WordPress 0 ~ 1.2.7 -
spiderdevs Forumax – AI Powered Advanced Community Forum Plugin 0 ~ 1.2.7 -
seezee Five-Star Ratings Shortcode 0 ~ 1.2.56 -
oxilab Product Layouts for WooCommerce 0 ~ 1.3.1 -
mr2p Meta Field Block – Display custom fields in the Block Editor without coding 0 ~ 1.3.3 -
themelocation Custom WooCommerce Checkout Fields Editor 0 ~ 1.3.4 -
100plugins Open User Map 0 ~ 1.4.0 -
wpdever WP Notification Bell 0 ~ 1.4.2 -
themelocation Remove Add to Cart WooCommerce 0 ~ 1.4.7 -
princeahmed File Manager for Google Drive – Integrate Google Drive 0 ~ 1.4.9 -
5starplugins Marijuana Age Verify 0 ~ 1.5.5 -
infosatech RevivePress – Keep your Old Content Evergreen 0 ~ 1.5.8 -
nicheaddons Restaurant & Cafe Addon for Elementor 0 ~ 1.5.8 -
paretodigital Send Users Email – Email Subscribers, Email Marketing Newsletter 0 ~ 1.5.10 -
unitecms Unlimited Elements For Elementor 0 ~ 1.5.140 -
meowcrew Role Based Pricing for Woo by Meow Crew 0 ~ 1.6.0 -
nicheaddons Primary Addon for Elementor 0 ~ 1.6.0 -
5starplugins Featured Images in RSS for Mailchimp & More 0 ~ 1.6.3 -
wpsaad Image Alt Text Manager – Bulk & Dynamic Alt Tags For image SEO Optimization + AI 0 ~ 1.6.3 -
kofimokome Message Filter for Contact Form 7 0 ~ 1.6.3.2 -
paretodigital Embedder for Google Reviews 0 ~ 1.6.6 -
interactivegeomaps MapGeo – Interactive Geo Maps 0 ~ 1.6.22 -

II. Public POCs for CVE-2024-13362

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-13362

请登录查看更多情报信息。

Patches & Fixes for CVE-2024-13362 (2)

Vendor Advisories for CVE-2024-13362 (1)

IV. Related Vulnerabilities

Same weakness: CWE-79

V. Comments for CVE-2024-13362

No comments yet

Leave a comment