CVE Feed

    Dashboard / CVE / CVE-2024-13362

    CVE-2024-13362

    Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

    Published:May 1, 2026
    Last Modified:May 4, 2026
    EPS:May 1, 2026
    EPSS Score:0.00086
    CVSS Score:6.1

    Affected Products

    Vendor
    100plugins
    Product
    Open User Map
    Vendor
    5starplugins
    Product
    Dynamic Copyright Year
    Vendor
    5starplugins
    Product
    Easy Age Verify
    Vendor
    5starplugins
    Product
    Featured Images In Rss For Mailchimp & More
    Vendor
    Afthemes
    Product
    Wp Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars
    Vendor
    Bensibley
    Product
    Independent Analytics
    Vendor
    Blackandwhitedigital
    Product
    Treepress – Easy Family Trees & Ancestor Profiles
    Vendor
    Blockspare
    Product
    Blockspare — News, Magazine And Blog Addons For (gutenberg) Block Editor
    Vendor
    Bouncingsprout
    Product
    Ultimeter
    Vendor
    Bplugins
    Product
    Advanced Scrollbar – Custom Scrollbar Styling And Behavior
    Vendor
    Bplugins
    Product
    Bblocks – Essential Gutenberg Blocks & Patterns Collection
    Vendor
    Bplugins
    Product
    Html5 Audio Player – The Ultimate No-code Podcast, Mp3 & Audio Player
    Vendor
    Bplugins
    Product
    Pdf Poster – Display Pdf Files With Custom Viewer
    Vendor
    Bulletin
    Product
    Announcement & Notification Banner - Bulletin
    Vendor
    Cleverplugins
    Product
    Security Ninja – Wordpress Security & Firewall
    Vendor
    Codesavory
    Product
    Knowledge Base Documentation & Wiki Plugin – Basepress Docs
    Vendor
    Cyberhobo
    Product
    Geo Mashup
    Vendor
    Cyclonecode
    Product
    Custom Php Settings
    Vendor
    Damian-gora
    Product
    Justified Gallery
    Vendor
    Dashlabsltd
    Product
    Yasr – Yet Another Star Rating Plugin For Wordpress
    Vendor
    Davidanderson
    Product
    Internal Link Juicer: Seo Auto Linker For Wordpress
    Vendor
    Elespare
    Product
    Elespare – News, Magazine And Blog Addons For Elementor
    Vendor
    Elliotvs
    Product
    Coupon Affiliates – Affiliate Plugin For Woocommerce
    Vendor
    Enweby
    Product
    Full Screen Background
    Vendor
    Essekia
    Product
    Tablesome Table – Contact Form Db – Wpforms, Cf7, Gravity, Forminator, Fluent
    Vendor
    Fooplugins
    Product
    Gallery By Foogallery
    Vendor
    Fooplugins
    Product
    Lightbox & Modal Popup Wordpress Plugin – Foobox
    Vendor
    Fooplugins
    Product
    Notification Bar, Announcement And Cookie Notice Wordpress Plugin – Foobar
    Vendor
    Fullworks
    Product
    Anti-spam Protection – No Api Key, Gdpr Friendly
    Vendor
    Fullworks
    Product
    Display Eventbrite Events
    Vendor
    Gallerycreator
    Product
    Mixed Media Gallery Blocks
    Vendor
    Gn Themes
    Product
    Wp Shortcodes Plugin — Shortcodes Ultimate
    Vendor
    Gowebsmarty
    Product
    Wp Encryption – One Click Free Ssl Certificate & Ssl / Https Redirect, Security & Ssl Scan
    Vendor
    Hasanazizul
    Product
    Text To Speech Tts Accessibility
    Vendor
    Hkdigitalagency
    Product
    Payment Gateway For Telcell
    Vendor
    Imtiazrayhan
    Product
    Wp Coupons And Deals – Coupon Plugin For Affiliate Marketers
    Vendor
    Inavii
    Product
    Inavii Social Feed
    Vendor
    Infornweb
    Product
    Blog Designer Pack – Blog, Post Grid, Post Slider, Post Carousel, Category Post, News
    Vendor
    Infornweb
    Product
    Logo Showcase – Responsive Logo Carousel, Logo Slider & Logo Grid
    Vendor
    Infornweb
    Product
    Post List Designer – Category Post, Recent Post, Post List
    Vendor
    Infosatech
    Product
    Revivepress – Keep Your Old Content Evergreen
    Vendor
    Interactive Geo Maps Project
    Product
    Interactive Geo Maps
    Vendor
    Invisnet
    Product
    Wp Fail2ban – Advanced Security
    Vendor
    Josevega
    Product
    Bulk Edit Posts And Products In Spreadsheet
    Vendor
    Josevega
    Product
    Disable Payment Methods Based On Cart Conditions For Woocommerce
    Vendor
    Josevega
    Product
    Wp Page Templates
    Vendor
    Kaira
    Product
    Storecustomizer – A Plugin To Customize All Woocommerce Pages
    Vendor
    Kaizencoders
    Product
    Url Shortify – Simple And Easy Url Shortener
    Vendor
    Koen12344
    Product
    Post To Google My Business (google Business Profile)
    Vendor
    Kofimokome
    Product
    Message Filter For Contact Form 7
    Vendor
    Litonice13
    Product
    Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits
    Vendor
    Mapster
    Product
    Mapster Wp Maps
    Vendor
    Mattpramschufer
    Product
    Pay For Post With Woocommerce
    Vendor
    Meowcrew
    Product
    Role Based Pricing For Woo By Meow Crew
    Vendor
    Mhmrajib
    Product
    Aidwp – Donation & Payment Forms (stripe Powered)
    Vendor
    Mhmrajib
    Product
    Topnewswp – Display Tikcer News, Rss Feed Widget And Many More
    Vendor
    Mhmrajib
    Product
    Wp Books Gallery – Build Stunning Book Showcases & Libraries In Minutes
    Vendor
    Mihail Barinov
    Product
    Share This Image
    Vendor
    Mohsinoffline
    Product
    Secure Gateway For Authorize.net And Woocommerce By Pledged Plugins
    Vendor
    Mr2p
    Product
    Meta Field Block – Display Custom Fields In The Block Editor Without Coding
    Vendor
    Mte90
    Product
    Glossary
    Vendor
    Nicheaddons
    Product
    Events Addon For Elementor
    Vendor
    Nicheaddons
    Product
    Primary Addon For Elementor
    Vendor
    Nicheaddons
    Product
    Restaurant & Cafe Addon For Elementor
    Vendor
    Nitin247
    Product
    Place Order Without Payment For Woocommerce
    Vendor
    Nitin247
    Product
    Thank You Page For Woocommerce
    Vendor
    Oceanwp
    Product
    Ocean Extra
    Vendor
    Oxilab
    Product
    Product Layouts For Woocommerce
    Vendor
    Pagup
    Product
    Automatic Internal Links For Seo By Pagup
    Vendor
    Pagup
    Product
    Bulk Auto Image Alt Text (alt Tag, Alt Attribute) Optimizer (image Seo)
    Vendor
    Pareto Digital
    Product
    Embedder For Google Reviews
    Vendor
    Paretodigital
    Product
    Send Users Email – Email Subscribers, Email Marketing Newsletter
    Vendor
    Passionatebrains
    Product
    Aeh Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading & Image Optimization
    Vendor
    Passionatebrains
    Product
    Awca – The Great Analytics Insights For Your Estore
    Vendor
    Passionatebrains
    Product
    Ga4wp – Analytics Dashboard For The Website
    Vendor
    Peterschulznl
    Product
    Code Manager
    Vendor
    Peterschulznl
    Product
    Wp Data Access – No-code App Builder With Tables, Forms, Charts & Maps
    Vendor
    Pluginandplay
    Product
    Post Slider And Post Carousel With Post Vertical Scrolling Widget – A Responsive Post Slider
    Vendor
    Plugins360
    Product
    Automatic Youtube Gallery
    Vendor
    Pluginscafe
    Product
    Smart Phone Field For Gravity Forms
    Vendor
    Pluginsware
    Product
    Advanced Classifieds & Directory Pro
    Vendor
    Prasadkirpekar
    Product
    Wp Meta And Date Remover
    Vendor
    Premmerce
    Product
    Permalink Manager For Woocommerce
    Vendor
    Premmerce
    Product
    Premmerce Product Filter For Woocommerce
    Vendor
    Princeahmed
    Product
    Dracula Dark Mode – Accessibility, Reading Mode & Dark Mode For Wordpress
    Vendor
    Princeahmed
    Product
    File Manager For Google Drive – Integrate Google Drive
    Vendor
    Princeahmed
    Product
    Radio Player Live Shout Cast Ice Cast And Any Audio Stream Player For Wordpress
    Vendor
    Rebelcode
    Product
    Spotlight Social Feeds – Block, Shortcode, And Widget
    Vendor
    Saadiqbal
    Product
    Post Smtp – Complete Email Deliverability And Smtp Solution With Email Logs, Alerts, Backup Smtp & Mobile App
    Vendor
    Samdani
    Product
    Solid Testimonials – Testimonial Slider, Video Testimonials & Customer Reviews
    Vendor
    Samdani
    Product
    Team Members – A Wordpress Team Plugin With Gallery, Grid, Carousel, Slider, Table, List, And More
    Vendor
    Sebet
    Product
    Go Fetch Jobs (for Wp Job Manager)
    Vendor
    Seezee
    Product
    Five-star Ratings Shortcode
    Vendor
    Senols
    Product
    Ai Puffer – Chat. Create. Automate. (formerly Ai Power)
    Vendor
    Sjaved
    Product
    Easy Social Feed – Social Photos Gallery And Post Feed For Wordpress
    Vendor
    Smartwpress
    Product
    Music Player For Elementor – Audio Player & Podcast Player
    Vendor
    Speedify
    Product
    Auto-install Free Ssl – Generate & Install Free Ssl Certificates
    Vendor
    Spicethemes
    Product
    Carousel, Recent Post Slider And Banner Slider
    Vendor
    Spiderdevs
    Product
    Eazydocs – Ai Powered Knowledge Base, Wiki, Documentation & Faq Builder
    Vendor
    Spiderdevs
    Product
    Forumax – Ai Powered Advanced Community Forum Plugin
    Vendor
    Streamweasels
    Product
    Twitch Integration
    Vendor
    Takanakui
    Product
    Menu Image, Icons Made Easy
    Vendor
    Takanakui
    Product
    Wp Mobile Menu – The Mobile-friendly Responsive Menu
    Vendor
    Theafricanboss
    Product
    Checkout With Cash App On Woocommerce
    Vendor
    Themelocation
    Product
    Custom Woocommerce Checkout Fields Editor
    Vendor
    Themelocation
    Product
    Remove Add To Cart Woocommerce
    Vendor
    Tickera
    Product
    Restrict – Membership, Site, Content And User Access Restrictions For Wordpress
    Vendor
    Tobias Conrad
    Product
    Wow Styler For Cf7 – Visual Styler For Contact Form 7 Forms
    Vendor
    Tobiasbg
    Product
    Tablepress – Tables In Wordpress Made Easy
    Vendor
    Toddhalfpenny
    Product
    Widgets On Pages
    Vendor
    Tonyzeoli
    Product
    Radio Station By Netmix® – Manage And Play Your Show Schedule In Wordpress!
    Vendor
    Tripetto
    Product
    Wordpress Form Builder Plugin For Contact Forms, Surveys And Quizzes – Tripetto
    Vendor
    Unitecms
    Product
    Unlimited Elements For Elementor
    Vendor
    Uriahs-victor
    Product
    Kikote – Location Picker At Checkout & Google Address Autofill Plugin For Woocommerce
    Vendor
    Vinod-dalvi
    Product
    Ivory Search – Wordpress Search Plugin
    Vendor
    Webba-agency
    Product
    Easy Appointment Booking & Scheduling System – Webba Booking Calendar
    Vendor
    Webfactory
    Product
    Ai Bud – Ai Content Generator, Ai Chatbot, Chatgpt, Gemini, Gpt-4o
    Vendor
    Webheadllc
    Product
    Contact Form 7 Multi-step Forms
    Vendor
    Wordplus
    Product
    Better Messages – Live Chat, Chat Rooms, Real-time Messaging & Private Messages
    Vendor
    Wordpress
    Product
    Wordpress
    Vendor
    Wpbits
    Product
    Wpbits Addons For Elementor Page Builder
    Vendor
    Wpdever
    Product
    Wp Notification Bell
    Vendor
    Wpjoli
    Product
    Joli Table Of Contents
    Vendor
    Wpmagics
    Product
    Delete Posts Automatically
    Vendor
    Wpsaad
    Product
    Image Alt Text Manager – Bulk & Dynamic Alt Tags For Image Seo Optimization + Ai
    Vendor
    Wpspeedo
    Product
    Team Members Showcase
    Vendor
    Xplodedthemes
    Product
    Wpide - File Manager & Code Editor
    Vendor
    Xplodedthemes
    Product
    Xt Floating Cart For Woocommerce
    Vendor
    Xplodedthemes
    Product
    Xt Quick View For Woocommerce
    Vendor
    Yuvalo
    Product
    Goal Tracker – Custom Event Tracking For Ga4

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-84818 (CVSS 7.1) — Unauthenticated Cross Site Scripting (XSS) in Open User Map <= 1.4.50 versions.…
    CVE-2026-66445 (CVSS 6.5) — Contributor Cross Site Scripting (XSS) in Open User Map <= 1.4.46 versions.…
    CVE-2026-2827 (CVSS 4.7) — The Open User Map PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'oum_location_…
    CVE-2025-68002 (CVSS 6.5) — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in 100plugins Ope…
    CVE-2025-57953 (CVSS 6.5) — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 100plugi…
    CVE-2024-32594 (CVSS 6.5) — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AttesaWP…
    CVE-2023-45056 (CVSS 5.9) — Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in 100plugins Open User Map plugin <= 1.3.26 ve…

    References

    https://plugins.trac.wordpress.org/browser/add-search-to-menu/trunk/includes/freemius/assets/js/pricing/freemius-pricing.js
    https://plugins.trac.wordpress.org/browser/featured-images-for-rss-feeds/trunk/includes/freemius/assets/js/pricing/freemius-pricing.js
    https://plugins.trac.wordpress.org/browser/foobox-image-lightbox/tags/2.7.33/freemius/assets/js/pricing/freemius-pricing.js
    https://plugins.trac.wordpress.org/browser/foogallery/tags/2.4.27/freemius/assets/js/pricing/freemius-pricing.js
    https://plugins.trac.wordpress.org/browser/independent-analytics/trunk/freemius/assets/js/pricing/freemius-pricing.js
    https://plugins.trac.wordpress.org/browser/interactive-geo-maps/tags/1.6.21/vendor/freemius/wordpress-sdk/assets/js/pricing/freemius-pricing.js
    https://plugins.trac.wordpress.org/browser/internal-links/trunk/vendor/freemius/wordpress-sdk/assets/js/pricing/freemius-pricing.js
    https://plugins.trac.wordpress.org/browser/master-addons/trunk/lib/freemius/assets/js/pricing/freemius-pricing.js
    https://plugins.trac.wordpress.org/browser/menu-image/trunk/freemius/assets/js/pricing/freemius-pricing.js
    https://plugins.trac.wordpress.org/browser/ocean-extra/trunk/includes/freemius/assets/js/pricing/freemius-pricing.js
    https://plugins.trac.wordpress.org/browser/pdf-poster/trunk/freemius/assets/js/pricing/freemius-pricing.js
    https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/freemius/assets/js/pricing/freemius-pricing.js
    https://plugins.trac.wordpress.org/browser/simply-gallery-block/trunk/freemius/assets/js/pricing/freemius-pricing.js
    https://plugins.trac.wordpress.org/browser/spotlight-social-photo-feeds/trunk/ui/freemius-pricing/freemius-pricing.js
    https://plugins.trac.wordpress.org/browser/tablepress/trunk/libraries/freemius/assets/js/pricing/freemius-pricing.js
    https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/provider/freemius/assets/js/pricing/freemius-pricing.js
    https://plugins.trac.wordpress.org/browser/widgets-on-pages/trunk/freemius/assets/js/pricing/freemius-pricing.js
    https://plugins.trac.wordpress.org/browser/woo-permalink-manager/tags/2.3.11/assets/admin/js/pricing-page/freemius-pricing.js
    https://plugins.trac.wordpress.org/browser/wp-meta-and-date-remover/tags/2.3.4/freemius/assets/js/pricing/freemius-pricing.js
    https://plugins.trac.wordpress.org/browser/wpide/tags/3.5.0/dist/pricing/freemius-pricing.js
    https://plugins.trac.wordpress.org/changeset/3229060/
    https://plugins.trac.wordpress.org/changeset/3235286/
    https://plugins.trac.wordpress.org/changeset/3249130/
    https://www.wordfence.com/threat-intel/vulnerabilities/id/d694491c-c0f5-4418-805a-db792ea4f712?source=cve

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High