MEDIUM
CVE-2024-13362
CVE-2024-13362 — Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Published Updated Sources: cvelistV5, Wordfence
Triage
Is it exploited, how likely is exploitation, what does it touch, and how severe do the scoring sources call it.
Exploitation
Unreported
no source claims exploitation
EPSS
0%
chance of exploitation in 30 days
CVSS base
6.1
MEDIUM
CISA SSVC assessment
Three decision points CISA publishes for the CVEs it assesses · SSVC 2.0.3. A stakeholder decision, not a severity score.
CISA
Exploitation
None
none · proof-of-concept · active
Automatable
No
can an attacker script all four kill-chain steps
Technical impact
Partial
partial · total control of the vulnerable component
Affected scope
The catalog records vendors and products as separate lists, not pairs, so which product belongs to which vendor is not something this page can say.
Vendors (98)
sebet5starpluginspeterschulznlbpluginsyuvaloessekiajosevegahkdigitalagencyprinceahmedspiderdevsseezeeoxilabmr2pthemelocation100pluginswpdeverinfosatechnicheaddonsparetodigitalunitecmsmeowcrewwpsaadkofimokomeinteractivegeomapswpbitstoddhalfpennyrebelcodetobias conradwebfactoryhasanazizulsenolsdamian goramapsterstreamweaselsxplodedthemeskaizencodersuriahs victorcyberhobopagupenwebylitonice13spicethemespluginscafefoopluginsmte90tickeracyclonecodeprasadkirpekarfullworkspremmercesmartwpressmhmrajiboceanwpplugins360samdanitonyzeolikairawpjolipassionatebrainsnitin247wordplusmihail barinovinaviitakanakuibensibleycodesavorydavidandersonsaadiqbaltobiasbgbouncingsproutblackandwhitedigitalmattpramschuferkoen12344imtiazrayhanpluginswaregallerycreatorblockspareinfornwebpluginandplaywpspeedoelesparedashlabsltdafthemeswpmagicsmikewire rocksolidwebheadllcspeedifywebba agencyinvisnetvinod dalvielliotvscleverpluginstheafricanbossmohsinofflinesjavedgn themesgowebsmartytripetto
Products (131)
go fetch jobs for wp job managerdynamic copyright yearcode manageradvanced scrollbar custom scrollbar styling and behaviorgoal tracker custom event tracking for ga4tablesome table contact form db wpforms cf7 gravity forminator fluentwp page templatespayment gateway for acba bankdracula dark mode accessibility reading mode dark mode for wordpressforumax ai powered advanced community forum pluginfive star ratings shortcodeproduct layouts for woocommercemeta field block display custom fields in the block editor without codingcustom woocommerce checkout fields editoropen user mapwp notification bellremove add to cart woocommercefile manager for google drive integrate google drivemarijuana age verifyrevivepress keep your old content evergreenrestaurant cafe addon for elementorsend users email email subscribers email marketing newsletterunlimited elements for elementorrole based pricing for woo by meow crewprimary addon for elementorfeatured images in rss for mailchimp moreimage alt text manager bulk dynamic alt tags for image seo optimization aimessage filter for contact form 7embedder for google reviewsmapgeo interactive geo mapswpbits addons for elementor page builderwidgets on pagesspotlight social feeds block shortcode and widgetwow styler for cf7 visual styler for contact form 7 formsai bud ai content generator ai chatbot chatgpt gemini gpt 4otext to speech tts accessibilityeasy age verifyai puffer chat create automate formerly ai powerjustified gallerymapster wp mapsstreamweasels twitch integrationxt variation swatches for woocommercebblocks essential gutenberg blocks patterns collectionurl shortify simple and easy url shortenerkikote location picker at checkout google address autofill plugin for woocommercegeo mashupdisable payment methods based on cart conditions for woocommerceautomatic internal links for seo by pagupfull screen backgroundmaster addons for elementor widgets extensions theme builder popup builder template kitsradio player live shoutcast icecast and any audio stream playercarousel recent post slider and banner sliderbulk auto image alt text alt tag alt attribute optimizer image seoxt quick view for woocommercesmart phone field for gravity formsnotification bar announcement and cookie notice wordpress plugin foobarpdf poster display pdf files with custom viewerevents addon for elementorhtml5 audio player the ultimate no code podcast mp3 audio playerglossaryrestrict membership site content and user access restrictions for wordpresscustom php settingswp meta and date removeranti spam protection no api key gdpr friendlypremmerce permalink manager for woocommercemusic player for elementor audio player podcast playertopnewswp display tikcer news rss feed widget and many moreocean extragallery by foogalleryautomatic youtube galleryeazydocs ai powered knowledge base wiki documentation faq builderteam members a wordpress team plugin with gallery grid carousel slider table list and moreradio station by netmix manage and play your show schedule in wordpressstorecustomizer a plugin to customize all woocommerce pagesjoli table of contentsga4wp analytics dashboard for the websiteplace order without payment for woocommercebetter messages live chat chat rooms real time messaging private messagesshare this imageinavii social feedlightbox modal popup wordpress plugin fooboxxt floating cart for woocommercewp mobile menu the mobile friendly responsive menuaeh speed optimization browser cache optimized minify lazy loading image optimizationindependent analyticsknowledge base documentation wiki plugin basepress docsinternal link juicer seo auto linker for wordpressbulk edit posts and products in spreadsheetpost smtp complete email deliverability and smtp solution with email logs alerts backup smtp mobile apptablepress tables in wordpress made easyultimetertreepress easy family trees ancestor profilespay for post with woocommercepost to google my business google business profilewp coupons and deals coupon plugin for affiliate marketersadvanced classifieds directory promixed media gallery blocksblockspare news magazine and blog addons for gutenberg block editoraidwp donation payment forms stripe poweredlogo showcase responsive logo carousel logo slider logo gridpost slider and post carousel with post vertical scrolling widget a responsive post slidersolid testimonials testimonial slider video testimonials customer reviewsteam members showcaseelespare news magazine and blog addons for elementorpost list designer category post recent post post listblog designer pack blog post grid post slider post carousel category post newsyasr yet another star rating plugin for wordpresswpide file manager code editorpremmerce product filter for woocommercewp post author author box multiple authors guest authors custom avatarsdelete posts automaticallymenu image icons made easyawca the great analytics insights for your estoreannouncement notification banner bulletinthank you page for woocommercecontact form 7 multi step formsauto install free ssl generate install free ssl certificateswp books gallery build stunning book showcases libraries in minuteseasy appointment booking scheduling system webba booking calendarwp fail2ban advanced securityivory search wordpress search pluginwp data access app builder for tables forms charts maps dashboardscoupon affiliates affiliate plugin for woocommercesecurity ninja wordpress security firewallcheckout with cash app on woocommercedisplay eventbrite eventssecure gateway for authorize net and woocommerce by pledged pluginseasy social feed social photos gallery and post feed for wordpresswp shortcodes plugin shortcodes ultimatewp encryption one click free ssl certificate ssl https redirect security ssl scanwordpress form builder plugin for contact forms surveys and quizzes tripetto
Every base score collected
Sources score independently and disagree; each row says who scored it and under which version.
| Score | Version | Severity | Expl. | Impact | Source |
|---|---|---|---|---|---|
| 6.1 | CVSS 3.1 | MEDIUM | — | — | cvelistV5 |
Weakness & attack patterns
- CWE-79
Detection
Read off the CVSS vector and the weakness class. Starting points, not rules we have tested.
- Search application, proxy, and WAF logs for requests touching /or.
References
24 on the record
- www.wordfence.com/threat-intel/vulnerabilities/id/d694491c-c0f5-4418-805a-db792ea4f712?source=cve
reference
- plugins.trac.wordpress.org/browser/tablepress/trunk/libraries/freemius/assets/js/pricing/freemius-pricing.js
reference
- plugins.trac.wordpress.org/browser/widgets-on-pages/trunk/freemius/assets/js/pricing/freemius-pricing.js
reference
- plugins.trac.wordpress.org/browser/menu-image/trunk/freemius/assets/js/pricing/freemius-pricing.js
reference
- plugins.trac.wordpress.org/browser/simply-gallery-block/trunk/freemius/assets/js/pricing/freemius-pricing.js
reference
- plugins.trac.wordpress.org/browser/foobox-image-lightbox/tags/2.7.33/freemius/assets/js/pricing/freemius-pricing.js
reference
- plugins.trac.wordpress.org/browser/featured-images-for-rss-feeds/trunk/includes/freemius/assets/js/pricing/freemius-pricing.js
reference
- plugins.trac.wordpress.org/browser/wpide/tags/3.5.0/dist/pricing/freemius-pricing.js
reference
Elsewhere on this site
- sebetevery CVE for this vendor
- 5starpluginsevery CVE for this vendor
- peterschulznlevery CVE for this vendor
- CWE-79other pages naming this weakness
Not in any source we poll
Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.
- No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
- No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
- No exploit packet captures, log samples, or incident case IDs supplied.