CVE-2024-13362: Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-01 · updated 2026-10-27
Weakness: CWE-79

Description

Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Affected products

100plugins Open User Map: through 1.4.0
5starplugins Dynamic Copyright Year: through 1.0.4
5starplugins Easy Age Verify: through 1.8.5
5starplugins Featured Images in RSS for Mailchimp & More: through 1.6.3
5starplugins Marijuana Age Verify: through 1.5.5
afthemes WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars: through 3.8.3
senols AI Puffer – Chat. Create. Automate. (formerly AI Power): through 1.8.99
bensibley Independent Analytics: through 2.9.7
blackandwhitedigital TreePress – Easy Family Trees & Ancestor Profiles: through 3.0.6
BlockSpare — News, Magazine and Blog Addons for (Gutenberg) Block Editor: through 3.2.6
bouncingsprout Ultimeter: through 3.0.5
bplugins Advanced Scrollbar – Custom Scrollbar Styling and Behavior: through 1.1.3
bplugins bBlocks – Essential Gutenberg Blocks & Patterns Collection: through 1.9.8
bplugins HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player: through 2.2.27
bplugins PDF Poster – Display PDF Files with Custom Viewer: through 2.2.0
mikewire_rocksolid Announcement & Notification Banner – Bulletin: through 3.12.1
cleverplugins Security Ninja – WordPress Security & Firewall: through 5.222
codesavory Knowledge Base documentation & wiki plugin – BasePress Docs: through 2.16.3.3
Dylan Kuhn Geo Mashup: through 1.13.15
cyclonecode Custom PHP Settings: through 2.3.1
damian-gora Justified Gallery: through 1.9.0
dashlabsltd YASR – Yet Another Star Rating Plugin for WordPress: through 3.4.12
sjaved Easy Social Feed – Social Photos Gallery and Post Feed for WordPress: through 6.6.5
EleSpare – News, Magazine and Blog Addons for Elementor: through 3.3.2
elliotvs Coupon Affiliates – Affiliate Plugin for WooCommerce: through 5.17.2
enweby Full Screen Background: through 2.0.2
essekia Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent: through 1.1.13
fooplugins Gallery by FooGallery: through 2.4.27
fooplugins Lightbox & Modal Popup WordPress Plugin – FooBox: through 2.7.33
fooplugins Notification Bar, Announcement and Cookie Notice WordPress Plugin – FooBar: through 2.1.34

References

Get alerted when CVE-2024-13362 or the next vulnerability affects your stack