{"id":"CVE-2024-13362","aliases":["EUVD-2024-55564","GHSA-c7cj-88jr-mhx2"],"status":"published","title":"Freemius \u003c= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter","description":"Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00276,"percentile":0.20249,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-05-01T05:29:54Z","modified":"2026-10-27T18:10:00Z","products":[{"vendor":"100plugins","product":"open user map"},{"vendor":"5starplugins","product":"dynamic copyright year"},{"vendor":"5starplugins","product":"easy age verify"},{"vendor":"5starplugins","product":"featured images in rss for mailchimp \u0026 more"},{"vendor":"5starplugins","product":"marijuana age verify"},{"vendor":"afthemes","product":"wp post author – author box, multiple authors, guest authors \u0026 custom avatars"},{"vendor":"bensibley","product":"independent analytics"},{"vendor":"blackandwhitedigital","product":"treepress – easy family trees \u0026 ancestor profiles"},{"vendor":"blockspare","product":"blockspare — news, magazine and blog addons for (gutenberg) block editor"},{"vendor":"bouncingsprout","product":"ultimeter"},{"vendor":"bplugins","product":"advanced scrollbar – custom scrollbar styling and behavior"},{"vendor":"bplugins","product":"bblocks – essential gutenberg blocks \u0026 patterns collection"},{"vendor":"bplugins","product":"html5 audio player – the ultimate no-code podcast, mp3 \u0026 audio player"},{"vendor":"bplugins","product":"pdf poster – display pdf files with custom viewer"},{"vendor":"cleverplugins","product":"security ninja – wordpress security \u0026 firewall"},{"vendor":"codesavory","product":"knowledge base documentation \u0026 wiki plugin – basepress docs"},{"vendor":"cyberhobo","product":"geo mashup"},{"vendor":"cyclonecode","product":"custom php settings"},{"vendor":"damian-gora","product":"justified gallery"},{"vendor":"dashlabsltd","product":"yasr – yet another star rating plugin for wordpress"},{"vendor":"davidanderson","product":"internal link juicer: seo auto linker for wordpress"},{"vendor":"elespare","product":"elespare – news, magazine and blog addons for elementor"},{"vendor":"elliotvs","product":"coupon affiliates – affiliate plugin for woocommerce"},{"vendor":"enweby","product":"full screen background"},{"vendor":"essekia","product":"tablesome table – contact form db – wpforms, cf7, gravity, forminator, fluent"},{"vendor":"fooplugins","product":"gallery by foogallery"},{"vendor":"fooplugins","product":"lightbox \u0026 modal popup wordpress plugin – foobox"},{"vendor":"fooplugins","product":"notification bar, announcement and cookie notice wordpress plugin – foobar"},{"vendor":"fullworks","product":"anti-spam protection – no api key, gdpr friendly"},{"vendor":"fullworks","product":"display eventbrite events"},{"vendor":"gallerycreator","product":"mixed media gallery blocks"},{"vendor":"gn_themes","product":"wp shortcodes plugin — shortcodes ultimate"},{"vendor":"gowebsmarty","product":"wp encryption – one click free ssl certificate \u0026 ssl / https redirect, security \u0026 ssl scan"},{"vendor":"hasanazizul","product":"text to speech tts accessibility"},{"vendor":"hkdigitalagency","product":"payment gateway for acba bank"},{"vendor":"imtiazrayhan","product":"wp coupons and deals – coupon plugin for affiliate marketers"},{"vendor":"inavii","product":"inavii social feed"},{"vendor":"infornweb","product":"blog designer pack – blog, post grid, post slider, post carousel, category post, news"},{"vendor":"infornweb","product":"logo showcase – responsive logo carousel, logo slider \u0026 logo grid"},{"vendor":"infornweb","product":"post list designer – category post, recent post, post list"},{"vendor":"infosatech","product":"revivepress – keep your old content evergreen"},{"vendor":"interactivegeomaps","product":"mapgeo – interactive geo maps"},{"vendor":"invisnet","product":"wp fail2ban – advanced security"},{"vendor":"josevega","product":"bulk edit posts and products in spreadsheet"},{"vendor":"josevega","product":"disable payment methods based on cart conditions for woocommerce"},{"vendor":"josevega","product":"wp page templates"},{"vendor":"kaira","product":"storecustomizer – a plugin to customize all woocommerce pages"},{"vendor":"kaizencoders","product":"url shortify – simple and easy url shortener"},{"vendor":"koen12344","product":"post to google my business (google business profile)"},{"vendor":"kofimokome","product":"message filter for contact form 7"},{"vendor":"litonice13","product":"master addons for elementor – widgets, extensions, theme builder, popup builder \u0026 template kits"},{"vendor":"mapster","product":"mapster wp maps"},{"vendor":"mattpramschufer","product":"pay for post with woocommerce"},{"vendor":"meowcrew","product":"role based pricing for woo by meow crew"},{"vendor":"mhmrajib","product":"aidwp – donation \u0026 payment forms (stripe powered)"},{"vendor":"mhmrajib","product":"topnewswp – display tikcer news, rss feed widget and many more"},{"vendor":"mhmrajib","product":"wp books gallery – build stunning book showcases \u0026 libraries in minutes"},{"vendor":"mihail-barinov","product":"share this image"},{"vendor":"mikewire_rocksolid","product":"announcement \u0026 notification banner – bulletin"},{"vendor":"mohsinoffline","product":"secure gateway for authorize.net and woocommerce by pledged plugins"},{"vendor":"mr2p","product":"meta field block – display custom fields in the block editor without coding"},{"vendor":"mte90","product":"glossary"},{"vendor":"nicheaddons","product":"events addon for elementor"},{"vendor":"nicheaddons","product":"primary addon for elementor"},{"vendor":"nicheaddons","product":"restaurant \u0026 cafe addon for elementor"},{"vendor":"nitin247","product":"place order without payment for woocommerce"},{"vendor":"nitin247","product":"thank you page for woocommerce"},{"vendor":"oceanwp","product":"ocean extra"},{"vendor":"oxilab","product":"product layouts for woocommerce"},{"vendor":"pagup","product":"automatic internal links for seo by pagup"},{"vendor":"pagup","product":"bulk auto image alt text (alt tag, alt attribute) optimizer (image seo)"},{"vendor":"paretodigital","product":"embedder for google reviews"},{"vendor":"paretodigital","product":"send users email – email subscribers, email marketing newsletter"},{"vendor":"passionatebrains","product":"aeh speed optimization: browser cache, optimized minify, lazy loading \u0026 image optimization"},{"vendor":"passionatebrains","product":"awca – the great analytics insights for your estore"},{"vendor":"passionatebrains","product":"ga4wp – analytics dashboard for the website"},{"vendor":"peterschulznl","product":"code manager"},{"vendor":"peterschulznl","product":"wp data access – app builder for tables, forms, charts, maps \u0026 dashboards"},{"vendor":"pluginandplay","product":"post slider and post carousel with post vertical scrolling widget – a responsive post slider"},{"vendor":"plugins360","product":"automatic youtube gallery"},{"vendor":"pluginscafe","product":"smart phone field for gravity forms"},{"vendor":"pluginsware","product":"advanced classifieds \u0026 directory pro"},{"vendor":"prasadkirpekar","product":"wp meta and date remover"},{"vendor":"premmerce","product":"premmerce permalink manager for woocommerce"},{"vendor":"premmerce","product":"premmerce product filter for woocommerce"},{"vendor":"princeahmed","product":"dracula dark mode –  accessibility, reading mode \u0026 dark mode for wordpress"},{"vendor":"princeahmed","product":"file manager for google drive – integrate google drive"},{"vendor":"princeahmed","product":"radio player – live shoutcast, icecast and any audio stream player"},{"vendor":"rebelcode","product":"spotlight social feeds – block, shortcode, and widget"},{"vendor":"saadiqbal","product":"post smtp – complete email deliverability and smtp solution with email logs, alerts, backup smtp \u0026 mobile app"},{"vendor":"samdani","product":"solid testimonials – testimonial slider, video testimonials \u0026 customer reviews"},{"vendor":"samdani","product":"team members – a wordpress team plugin with gallery, grid, carousel, slider, table, list, and more"},{"vendor":"sebet","product":"go fetch jobs (for wp job manager)"},{"vendor":"seezee","product":"five-star ratings shortcode"},{"vendor":"senols","product":"ai puffer – chat. create. automate. (formerly ai power)"},{"vendor":"sjaved","product":"easy social feed – social photos gallery and post feed for wordpress"},{"vendor":"smartwpress","product":"music player for elementor – audio player \u0026 podcast player"},{"vendor":"speedify","product":"auto-install free ssl – generate \u0026 install free ssl certificates"},{"vendor":"spicethemes","product":"carousel, recent post slider and banner slider"},{"vendor":"spiderdevs","product":"eazydocs – ai powered knowledge base, wiki, documentation \u0026 faq builder"},{"vendor":"spiderdevs","product":"forumax – ai powered advanced community forum plugin"},{"vendor":"streamweasels","product":"streamweasels twitch integration"},{"vendor":"takanakui","product":"menu image, icons made easy"},{"vendor":"takanakui","product":"wp mobile menu – the mobile-friendly responsive menu"},{"vendor":"theafricanboss","product":"checkout with cash app on woocommerce"},{"vendor":"themelocation","product":"custom woocommerce checkout fields editor"},{"vendor":"themelocation","product":"remove add to cart woocommerce"},{"vendor":"tickera","product":"restrict – membership, site, content and user access restrictions for wordpress"},{"vendor":"tobias_conrad","product":"wow styler for cf7 – visual styler for contact form 7 forms"},{"vendor":"tobiasbg","product":"tablepress – tables in wordpress made easy"},{"vendor":"toddhalfpenny","product":"widgets on pages"},{"vendor":"tonyzeoli","product":"radio station by netmix® – manage and play your show schedule in wordpress!"},{"vendor":"tripetto","product":"wordpress form builder plugin for contact forms, surveys and quizzes – tripetto"},{"vendor":"unitecms","product":"unlimited elements for elementor"},{"vendor":"uriahs-victor","product":"kikote – location picker at checkout \u0026 google address autofill plugin for woocommerce"},{"vendor":"vinod-dalvi","product":"ivory search – wordpress search plugin"},{"vendor":"webba-agency","product":"easy appointment booking \u0026 scheduling system – webba booking calendar"},{"vendor":"webfactory","product":"ai bud – ai content generator, ai chatbot, chatgpt, gemini, gpt-4o"},{"vendor":"webheadllc","product":"contact form 7 multi-step forms"},{"vendor":"wordplus","product":"better messages – live chat, chat rooms, real-time messaging \u0026 private messages"},{"vendor":"wpbits","product":"wpbits addons for elementor page builder"},{"vendor":"wpdever","product":"wp notification bell"},{"vendor":"wpjoli","product":"joli table of contents"},{"vendor":"wpmagics","product":"delete posts automatically"},{"vendor":"wpsaad","product":"image alt text manager – bulk \u0026 dynamic alt tags for image seo optimization + ai"},{"vendor":"wpspeedo","product":"team members showcase"},{"vendor":"xplodedthemes","product":"wpide – file manager \u0026 code editor"},{"vendor":"xplodedthemes","product":"xt floating cart for woocommerce"},{"vendor":"xplodedthemes","product":"xt quick view for woocommerce"},{"vendor":"xplodedthemes","product":"xt variation swatches for woocommerce"},{"vendor":"yuvalo","product":"goal tracker – custom event tracking for ga4"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d694491c-c0f5-4418-805a-db792ea4f712?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/tablepress/trunk/libraries/freemius/assets/js/pricing/freemius-pricing.js"},{"url":"https://plugins.trac.wordpress.org/browser/widgets-on-pages/trunk/freemius/assets/js/pricing/freemius-pricing.js"},{"url":"https://plugins.trac.wordpress.org/browser/menu-image/trunk/freemius/assets/js/pricing/freemius-pricing.js"},{"url":"https://plugins.trac.wordpress.org/browser/simply-gallery-block/trunk/freemius/assets/js/pricing/freemius-pricing.js"},{"url":"https://plugins.trac.wordpress.org/browser/foobox-image-lightbox/tags/2.7.33/freemius/assets/js/pricing/freemius-pricing.js"},{"url":"https://plugins.trac.wordpress.org/browser/featured-images-for-rss-feeds/trunk/includes/freemius/assets/js/pricing/freemius-pricing.js"},{"url":"https://plugins.trac.wordpress.org/browser/wpide/tags/3.5.0/dist/pricing/freemius-pricing.js"},{"url":"https://plugins.trac.wordpress.org/browser/add-search-to-menu/trunk/includes/freemius/assets/js/pricing/freemius-pricing.js"},{"url":"https://plugins.trac.wordpress.org/browser/master-addons/trunk/lib/freemius/assets/js/pricing/freemius-pricing.js"},{"url":"https://plugins.trac.wordpress.org/browser/foogallery/tags/2.4.27/freemius/assets/js/pricing/freemius-pricing.js"},{"url":"https://plugins.trac.wordpress.org/browser/ocean-extra/trunk/includes/freemius/assets/js/pricing/freemius-pricing.js"},{"url":"https://plugins.trac.wordpress.org/browser/internal-links/trunk/vendor/freemius/wordpress-sdk/assets/js/pricing/freemius-pricing.js"},{"url":"https://plugins.trac.wordpress.org/browser/interactive-geo-maps/tags/1.6.21/vendor/freemius/wordpress-sdk/assets/js/pricing/freemius-pricing.js"},{"url":"https://plugins.trac.wordpress.org/browser/independent-analytics/trunk/freemius/assets/js/pricing/freemius-pricing.js"},{"url":"https://plugins.trac.wordpress.org/browser/spotlight-social-photo-feeds/trunk/ui/freemius-pricing/freemius-pricing.js"},{"url":"https://plugins.trac.wordpress.org/browser/woo-permalink-manager/tags/2.3.11/assets/admin/js/pricing-page/freemius-pricing.js"},{"url":"https://plugins.trac.wordpress.org/browser/pdf-poster/trunk/freemius/assets/js/pricing/freemius-pricing.js"},{"url":"https://plugins.trac.wordpress.org/browser/wp-meta-and-date-remover/tags/2.3.4/freemius/assets/js/pricing/freemius-pricing.js"},{"url":"https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/provider/freemius/assets/js/pricing/freemius-pricing.js"},{"url":"https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/freemius/assets/js/pricing/freemius-pricing.js"},{"url":"https://plugins.trac.wordpress.org/changeset/3235286/"},{"url":"https://plugins.trac.wordpress.org/changeset/3249130/"},{"url":"https://plugins.trac.wordpress.org/changeset/3229060/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-13362"},{"url":"https://plugins.trac.wordpress.org/changeset/3229060"},{"url":"https://plugins.trac.wordpress.org/changeset/3235286"},{"url":"https://plugins.trac.wordpress.org/changeset/3249130"},{"url":"https://github.com/advisories/GHSA-c7cj-88jr-mhx2"}],"sources":{"cve":[{"id":"CVE-2024-13362","title":"Freemius \u003c= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter","description":"Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.","status":"published","published":"2026-05-01T05:29:54.148Z","modified":"2026-05-01T13:23:26.723Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:13.64024Z"}],"euvd":[{"id":"EUVD-2024-55564","description":"Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.","status":"published","published":"2026-05-01T05:29:54Z","modified":"2026-05-01T13:23:26Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:05:18.723006Z"}],"ghsa":[{"id":"GHSA-c7cj-88jr-mhx2","title":"Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via...","description":"Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.","status":"published","published":"2026-05-01T06:30:24Z","modified":"2026-05-01T06:30:30Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:07:52.84276Z"}],"nvd":[{"id":"CVE-2024-13362","description":"Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.","status":"published","published":"2026-05-01T06:16:30.05Z","modified":"2026-10-27T18:10:00.13Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:10:47.77313Z"}]}}