CVE-2024-13362 Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: sebet
product: Go Fetch Jobs (for WP Job Manager)
default_status: unaffected
vendor: 5starplugins
product: Dynamic Copyright Year
default_status: unaffected
vendor: peterschulznl
product: Code Manager
default_status: unaffected
vendor: bplugins
product: Advanced Scrollbar – Custom Scrollbar Styling and Behavior
default_status: unaffected
vendor: yuvalo
product: Goal Tracker – Custom Event Tracking for GA4
default_status: unaffected
vendor: essekia
product: Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent
default_status: unaffected
vendor: josevega
product: WP Page Templates
default_status: unaffected
vendor: hkdigitalagency
product: Payment Gateway for ACBA BANK
default_status: unaffected
vendor: princeahmed
product: Dracula Dark Mode –  Accessibility, Reading Mode & Dark Mode for WordPress
default_status: unaffected
vendor: spiderdevs
product: Forumax – AI Powered Advanced Community Forum Plugin
default_status: unaffected
vendor: seezee
product: Five-Star Ratings Shortcode
default_status: unaffected
vendor: oxilab
product: Product Layouts for WooCommerce
default_status: unaffected
vendor: mr2p
product: Meta Field Block – Display custom fields in the Block Editor without coding
default_status: unaffected
vendor: themelocation
product: Custom WooCommerce Checkout Fields Editor
default_status: unaffected
vendor: 100plugins
product: Open User Map
default_status: unaffected
vendor: wpdever
product: WP Notification Bell
default_status: unaffected
vendor: themelocation
product: Remove Add to Cart WooCommerce
default_status: unaffected
vendor: princeahmed
product: File Manager for Google Drive – Integrate Google Drive
default_status: unaffected
vendor: 5starplugins
product: Marijuana Age Verify
default_status: unaffected
vendor: infosatech
product: RevivePress – Keep your Old Content Evergreen
default_status: unaffected
vendor: nicheaddons
product: Restaurant & Cafe Addon for Elementor
default_status: unaffected
vendor: paretodigital
product: Send Users Email – Email Subscribers, Email Marketing Newsletter
default_status: unaffected
vendor: unitecms
product: Unlimited Elements For Elementor
default_status: unaffected
vendor: meowcrew
product: Role Based Pricing for Woo by Meow Crew
default_status: unaffected
vendor: nicheaddons
product: Primary Addon for Elementor
default_status: unaffected
vendor: 5starplugins
product: Featured Images in RSS for Mailchimp & More
default_status: unaffected
vendor: wpsaad
product: Image Alt Text Manager – Bulk & Dynamic Alt Tags For image SEO Optimization + AI
default_status: unaffected
vendor: kofimokome
product: Message Filter for Contact Form 7
default_status: unaffected
vendor: paretodigital
product: Embedder for Google Reviews
default_status: unaffected
vendor: interactivegeomaps
product: MapGeo – Interactive Geo Maps
default_status: unaffected
vendor: wpbits
product: WPBITS Addons For Elementor Page Builder
default_status: unaffected
vendor: toddhalfpenny
product: Widgets on Pages
default_status: unaffected
vendor: rebelcode
product: Spotlight Social Feeds – Block, Shortcode, and Widget
default_status: unaffected
vendor: tobias_conrad
product: WOW Styler for CF7 – Visual Styler for Contact Form 7 Forms
default_status: unaffected
vendor: webfactory
product: AI Bud – AI Content Generator, AI Chatbot, ChatGPT, Gemini, GPT-4o
default_status: unaffected
vendor: hasanazizul
product: Text To Speech TTS Accessibility
default_status: unaffected
vendor: 5starplugins
product: Easy Age Verify
default_status: unaffected
vendor: senols
product: AI Puffer – Chat. Create. Automate. (formerly AI Power)
default_status: unaffected
vendor: damian-gora
product: Justified Gallery
default_status: unaffected
vendor: mapster
product: Mapster WP Maps
default_status: unaffected
vendor: streamweasels
product: StreamWeasels Twitch Integration
default_status: unaffected
vendor: xplodedthemes
product: XT Variation Swatches for WooCommerce
default_status: unaffected
vendor: bplugins
product: bBlocks – Essential Gutenberg Blocks & Patterns Collection
default_status: unaffected
vendor: kaizencoders
product: URL Shortify – Simple and Easy URL Shortener
default_status: unaffected
vendor: uriahs-victor
product: Kikote – Location Picker at Checkout & Google Address AutoFill Plugin for WooCommerce
default_status: unaffected
vendor: cyberhobo
product: Geo Mashup
default_status: unaffected
vendor: josevega
product: Disable Payment Methods based on cart conditions for WooCommerce
default_status: unaffected
vendor: pagup
product: Automatic Internal Links for SEO by Pagup
default_status: unaffected
vendor: enweby
product: Full Screen Background
default_status: unaffected
vendor: litonice13
product: Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits
default_status: unaffected
vendor: princeahmed
product: Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player
default_status: unaffected
vendor: spicethemes
product: Carousel, Recent Post Slider and Banner Slider
default_status: unaffected
vendor: pagup
product: Bulk Auto Image Alt Text (Alt tag, Alt attribute) optimizer (image SEO)
default_status: unaffected
vendor: xplodedthemes
product: XT Quick View for WooCommerce
default_status: unaffected
vendor: pluginscafe
product: Smart phone field for Gravity Forms
default_status: unaffected
vendor: fooplugins
product: Notification Bar, Announcement and Cookie Notice WordPress Plugin – FooBar
default_status: unaffected
vendor: bplugins
product: PDF Poster – Display PDF Files with Custom Viewer
default_status: unaffected
vendor: nicheaddons
product: Events Addon for Elementor
default_status: unaffected
vendor: bplugins
product: HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player
default_status: unaffected
vendor: mte90
product: Glossary
default_status: unaffected
vendor: tickera
product: Restrict – membership, site, content and user access restrictions for WordPress
default_status: unaffected
vendor: cyclonecode
product: Custom PHP Settings
default_status: unaffected
vendor: prasadkirpekar
product: WP Meta and Date Remover
default_status: unaffected
vendor: fullworks
product: Anti-Spam Protection – No API Key, GDPR Friendly
default_status: unaffected
vendor: premmerce
product: Premmerce Permalink Manager for WooCommerce
default_status: unaffected
vendor: smartwpress
product: Music Player for Elementor – Audio Player & Podcast Player
default_status: unaffected
vendor: mhmrajib
product: TopNewsWp – Display Tikcer News, RSS Feed Widget and Many More
default_status: unaffected
vendor: oceanwp
product: Ocean Extra
default_status: unaffected
vendor: fooplugins
product: Gallery by FooGallery
default_status: unaffected
vendor: plugins360
product: Automatic YouTube Gallery
default_status: unaffected
vendor: spiderdevs
product: EazyDocs – AI Powered Knowledge Base, Wiki, Documentation & FAQ Builder
default_status: unaffected
vendor: samdani
product: Team Members – A WordPress Team Plugin with Gallery, Grid, Carousel, Slider, Table, List, and More
default_status: unaffected
vendor: tonyzeoli
product: Radio Station by netmix® – Manage and play your Show Schedule in WordPress!
default_status: unaffected
vendor: kaira
product: StoreCustomizer – A plugin to Customize all WooCommerce Pages
default_status: unaffected
vendor: wpjoli
product: Joli Table Of Contents
default_status: unaffected
vendor: passionatebrains
product: GA4WP – Analytics Dashboard for the Website
default_status: unaffected
vendor: nitin247
product: Place Order Without Payment for WooCommerce
default_status: unaffected
vendor: wordplus
product: Better Messages – Live Chat, Chat Rooms, Real-Time Messaging & Private Messages
default_status: unaffected
vendor: mihail-barinov
product: Share This Image
default_status: unaffected
vendor: inavii
product: Inavii Social Feed
default_status: unaffected
vendor: fooplugins
product: Lightbox & Modal Popup WordPress Plugin – FooBox
default_status: unaffected
vendor: xplodedthemes
product: XT Floating Cart for WooCommerce
default_status: unaffected
vendor: takanakui
product: WP Mobile Menu – The Mobile-Friendly Responsive Menu
default_status: unaffected
vendor: passionatebrains
product: AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading & Image Optimization
default_status: unaffected
vendor: bensibley
product: Independent Analytics
default_status: unaffected
vendor: codesavory
product: Knowledge Base documentation & wiki plugin – BasePress Docs
default_status: unaffected
vendor: davidanderson
product: Internal Link Juicer: SEO Auto Linker for WordPress
default_status: unaffected
vendor: josevega
product: Bulk Edit Posts and Products in Spreadsheet
default_status: unaffected
vendor: saadiqbal
product: Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App
default_status: unaffected
vendor: tobiasbg
product: TablePress – Tables in WordPress made easy
default_status: unaffected
vendor: bouncingsprout
product: Ultimeter
default_status: unaffected
vendor: blackandwhitedigital
product: TreePress – Easy Family Trees & Ancestor Profiles
default_status: unaffected
vendor: mattpramschufer
product: Pay For Post with WooCommerce
default_status: unaffected
vendor: koen12344
product: Post to Google My Business (Google Business Profile)
default_status: unaffected
vendor: imtiazrayhan
product: WP Coupons and Deals – Coupon Plugin For Affiliate Marketers
default_status: unaffected
vendor: pluginsware
product: Advanced Classifieds & Directory Pro
default_status: unaffected
vendor: gallerycreator
product: Mixed Media Gallery Blocks
default_status: unaffected
vendor: blockspare
product: BlockSpare — News, Magazine and Blog Addons for (Gutenberg) Block Editor
default_status: unaffected
vendor: mhmrajib
product: AidWP – Donation & Payment Forms (Stripe Powered)
default_status: unaffected
vendor: infornweb
product: Logo Showcase – Responsive Logo Carousel, Logo Slider & Logo Grid
default_status: unaffected
vendor: pluginandplay
product: Post Slider and Post Carousel with Post Vertical Scrolling Widget – A Responsive Post Slider
default_status: unaffected
vendor: samdani
product: Solid Testimonials – Testimonial Slider, Video Testimonials & Customer Reviews
default_status: unaffected
vendor: wpspeedo
product: Team Members Showcase
default_status: unaffected
vendor: elespare
product: EleSpare – News, Magazine and Blog Addons for Elementor
default_status: unaffected
vendor: infornweb
product: Post List Designer – Category Post, Recent Post, Post List
default_status: unaffected
vendor: infornweb
product: Blog Designer Pack – Blog, Post Grid, Post Slider, Post Carousel, Category Post, News
default_status: unaffected
vendor: dashlabsltd
product: YASR – Yet Another Star Rating Plugin for WordPress
default_status: unaffected
vendor: xplodedthemes
product: WPIDE – File Manager & Code Editor
default_status: unaffected
vendor: premmerce
product: Premmerce Product Filter for WooCommerce
default_status: unaffected
vendor: afthemes
product: WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars
default_status: unaffected
vendor: wpmagics
product: Delete Posts automatically
default_status: unaffected
vendor: takanakui
product: Menu Image, Icons made easy
default_status: unaffected
vendor: passionatebrains
product: AWCA – The Great Analytics Insights for Your eStore
default_status: unaffected
vendor: mikewire_rocksolid
product: Announcement & Notification Banner – Bulletin
default_status: unaffected
vendor: nitin247
product: Thank You Page for WooCommerce
default_status: unaffected
vendor: webheadllc
product: Contact Form 7 Multi-Step Forms
default_status: unaffected
vendor: speedify
product: Auto-Install Free SSL – Generate & Install Free SSL Certificates
default_status: unaffected
vendor: mhmrajib
product: WP Books Gallery – Build Stunning Book Showcases & Libraries in Minutes
default_status: unaffected
vendor: webba-agency
product: Easy Appointment Booking & Scheduling System – Webba Booking Calendar
default_status: unaffected
vendor: invisnet
product: WP fail2ban – Advanced Security
default_status: unaffected
vendor: vinod-dalvi
product: Ivory Search – WordPress Search Plugin
default_status: unaffected
vendor: peterschulznl
product: WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards
default_status: unaffected
vendor: elliotvs
product: Coupon Affiliates – Affiliate Plugin for WooCommerce
default_status: unaffected
vendor: cleverplugins
product: Security Ninja – WordPress Security & Firewall
default_status: unaffected
vendor: theafricanboss
product: Checkout with Cash App on WooCommerce
default_status: unaffected
vendor: fullworks
product: Display Eventbrite Events
default_status: unaffected
vendor: mohsinoffline
product: Secure Gateway for Authorize.net and WooCommerce by Pledged Plugins
default_status: unaffected
vendor: sjaved
product: Easy Social Feed – Social Photos Gallery and Post Feed for WordPress
default_status: unaffected
vendor: gn_themes
product: WP Shortcodes Plugin — Shortcodes Ultimate
default_status: unaffected
vendor: gowebsmarty
product: WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan
default_status: unaffected
vendor: tripetto
product: WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
baseScore: 6.1
baseSeverity: MEDIUM
Credits: lang: en
value: Asaf Mozes
Published: 2026-05-01T05:29:54.148Z