CVE-2024-13362
Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
6.1 Medium
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
0.28%Up 0.2 points since May 1, 2026
What each source reports
CVE List Score used
Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Record
CVE-2024-13362- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2024-55564
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Record
EUVD-2024-55564- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-c7cj-88jr-mhx2
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via...
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Record
GHSA-c7cj-88jr-mhx2- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Record
CVE-2024-13362- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
- 100plugins open user map
- 5starplugins dynamic copyright year
- 5starplugins easy age verify
- 5starplugins featured images in rss for mailchimp & more
- 5starplugins marijuana age verify
- afthemes wp post author – author box, multiple authors, guest authors & custom avatars
- bensibley independent analytics
- blackandwhitedigital treepress – easy family trees & ancestor profiles
- blockspare — news, magazine and blog addons for (gutenberg) block editor
- bouncingsprout ultimeter
- bplugins advanced scrollbar – custom scrollbar styling and behavior
- bplugins bblocks – essential gutenberg blocks & patterns collection
Show 119 moreShow less
- bplugins html5 audio player – the ultimate no-code podcast, mp3 & audio player
- bplugins pdf poster – display pdf files with custom viewer
- cleverplugins security ninja – wordpress security & firewall
- codesavory knowledge base documentation & wiki plugin – basepress docs
- cyberhobo geo mashup
- cyclonecode custom php settings
- damian-gora justified gallery
- dashlabsltd yasr – yet another star rating plugin for wordpress
- davidanderson internal link juicer: seo auto linker for wordpress
- elespare – news, magazine and blog addons for elementor
- elliotvs coupon affiliates – affiliate plugin for woocommerce
- enweby full screen background
- essekia tablesome table – contact form db – wpforms, cf7, gravity, forminator, fluent
- fooplugins gallery by foogallery
- fooplugins lightbox & modal popup wordpress plugin – foobox
- fooplugins notification bar, announcement and cookie notice wordpress plugin – foobar
- fullworks anti-spam protection – no api key, gdpr friendly
- fullworks display eventbrite events
- gallerycreator mixed media gallery blocks
- gn themes wp shortcodes plugin — shortcodes ultimate
- gowebsmarty wp encryption – one click free ssl certificate & ssl / https redirect, security & ssl scan
- hasanazizul text to speech tts accessibility
- hkdigitalagency payment gateway for acba bank
- imtiazrayhan wp coupons and deals – coupon plugin for affiliate marketers
- inavii social feed
- infornweb blog designer pack – blog, post grid, post slider, post carousel, category post, news
- infornweb logo showcase – responsive logo carousel, logo slider & logo grid
- infornweb post list designer – category post, recent post, post list
- infosatech revivepress – keep your old content evergreen
- interactivegeomaps mapgeo – interactive geo maps
- invisnet wp fail2ban – advanced security
- josevega bulk edit posts and products in spreadsheet
- josevega disable payment methods based on cart conditions for woocommerce
- josevega wp page templates
- kaira storecustomizer – a plugin to customize all woocommerce pages
- kaizencoders url shortify – simple and easy url shortener
- koen12344 post to google my business (google business profile)
- kofimokome message filter for contact form 7
- litonice13 master addons for elementor – widgets, extensions, theme builder, popup builder & template kits
- mapster wp maps
- mattpramschufer pay for post with woocommerce
- meowcrew role based pricing for woo by meow crew
- mhmrajib aidwp – donation & payment forms (stripe powered)
- mhmrajib topnewswp – display tikcer news, rss feed widget and many more
- mhmrajib wp books gallery – build stunning book showcases & libraries in minutes
- mihail-barinov share this image
- mikewire rocksolid announcement & notification banner – bulletin
- mohsinoffline secure gateway for authorize.net and woocommerce by pledged plugins
- mr2p meta field block – display custom fields in the block editor without coding
- mte90 glossary
- nicheaddons events addon for elementor
- nicheaddons primary addon for elementor
- nicheaddons restaurant & cafe addon for elementor
- nitin247 place order without payment for woocommerce
- nitin247 thank you page for woocommerce
- oceanwp ocean extra
- oxilab product layouts for woocommerce
- pagup automatic internal links for seo by pagup
- pagup bulk auto image alt text (alt tag, alt attribute) optimizer (image seo)
- paretodigital embedder for google reviews
- paretodigital send users email – email subscribers, email marketing newsletter
- passionatebrains aeh speed optimization: browser cache, optimized minify, lazy loading & image optimization
- passionatebrains awca – the great analytics insights for your estore
- passionatebrains ga4wp – analytics dashboard for the website
- peterschulznl code manager
- peterschulznl wp data access – app builder for tables, forms, charts, maps & dashboards
- pluginandplay post slider and post carousel with post vertical scrolling widget – a responsive post slider
- plugins360 automatic youtube gallery
- pluginscafe smart phone field for gravity forms
- pluginsware advanced classifieds & directory pro
- prasadkirpekar wp meta and date remover
- premmerce permalink manager for woocommerce
- premmerce product filter for woocommerce
- princeahmed dracula dark mode – accessibility, reading mode & dark mode for wordpress
- princeahmed file manager for google drive – integrate google drive
- princeahmed radio player – live shoutcast, icecast and any audio stream player
- rebelcode spotlight social feeds – block, shortcode, and widget
- saadiqbal post smtp – complete email deliverability and smtp solution with email logs, alerts, backup smtp & mobile app
- samdani solid testimonials – testimonial slider, video testimonials & customer reviews
- samdani team members – a wordpress team plugin with gallery, grid, carousel, slider, table, list, and more
- sebet go fetch jobs (for wp job manager)
- seezee five-star ratings shortcode
- senols ai puffer – chat. create. automate. (formerly ai power)
- sjaved easy social feed – social photos gallery and post feed for wordpress
- smartwpress music player for elementor – audio player & podcast player
- speedify auto-install free ssl – generate & install free ssl certificates
- spicethemes carousel, recent post slider and banner slider
- spiderdevs eazydocs – ai powered knowledge base, wiki, documentation & faq builder
- spiderdevs forumax – ai powered advanced community forum plugin
- streamweasels twitch integration
- takanakui menu image, icons made easy
- takanakui wp mobile menu – the mobile-friendly responsive menu
- theafricanboss checkout with cash app on woocommerce
- themelocation custom woocommerce checkout fields editor
- themelocation remove add to cart woocommerce
- tickera restrict – membership, site, content and user access restrictions for wordpress
- tobias conrad wow styler for cf7 – visual styler for contact form 7 forms
- tobiasbg tablepress – tables in wordpress made easy
- toddhalfpenny widgets on pages
- tonyzeoli radio station by netmix® – manage and play your show schedule in wordpress!
- tripetto wordpress form builder plugin for contact forms, surveys and quizzes – tripetto
- unitecms unlimited elements for elementor
- uriahs-victor kikote – location picker at checkout & google address autofill plugin for woocommerce
- vinod-dalvi ivory search – wordpress search plugin
- webba-agency easy appointment booking & scheduling system – webba booking calendar
- webfactory ai bud – ai content generator, ai chatbot, chatgpt, gemini, gpt-4o
- webheadllc contact form 7 multi-step forms
- wordplus better messages – live chat, chat rooms, real-time messaging & private messages
- wpbits addons for elementor page builder
- wpdever wp notification bell
- wpjoli joli table of contents
- wpmagics delete posts automatically
- wpsaad image alt text manager – bulk & dynamic alt tags for image seo optimization + ai
- wpspeedo team members showcase
- xplodedthemes wpide – file manager & code editor
- xplodedthemes xt floating cart for woocommerce
- xplodedthemes xt quick view for woocommerce
- xplodedthemes xt variation swatches for woocommerce
- yuvalo goal tracker – custom event tracking for ga4
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-13362 is a medium vulnerability (CVSS 6.1) in 100plugins Open User Map, published May 1, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. No source names a fixed version.
References
wordfence.com/threat-intel/vulnerabilities/id/d694491c-c0f5-4418-805a-db792ea4f712?source=cve
plugins.trac.wordpress.org/browser/tablepress/trunk/libraries/freemius/assets/js/pricing/freemius-pricing.js
Show 20 moreShow less
nvd.nist.gov/vuln/detail/CVE-2024-13362
github.com/advisories/GHSA-c7cj-88jr-mhx2