IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
6.1Media

CVE-2024-13362Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter

sebet Go Fetch Jobs (for WP Job Manager); 5starplugins Dynamic Copyright Year; peterschulznl Code Manager; bplugins Advanced Scrollbar – Custom Scrollbar Styli… Publicada: (hace 6 meses)

Descripción

Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Debilidad (CWE): CWE-79

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
100plugins Open User Map ≤ 1.4.0
5starplugins Dynamic Copyright Year ≤ 1.0.4
5starplugins Easy Age Verify ≤ 1.8.5
5starplugins Featured Images in RSS for Mailchimp & More ≤ 1.6.3
5starplugins Marijuana Age Verify ≤ 1.5.5
bplugins Advanced Scrollbar – Custom Scrollbar Styling and Behavior ≤ 1.1.3
bplugins bBlocks – Essential Gutenberg Blocks & Patterns Collection ≤ 1.9.8
bplugins HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player ≤ 2.2.27
bplugins PDF Poster – Display PDF Files with Custom Viewer ≤ 2.2.0
cyberhobo Geo Mashup ≤ 1.13.15
cyclonecode Custom PHP Settings ≤ 2.3.1
damian-gora Justified Gallery ≤ 1.9.0
enweby Full Screen Background ≤ 2.0.2
essekia Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent ≤ 1.1.13
fooplugins Gallery by FooGallery ≤ 2.4.27
fooplugins Notification Bar, Announcement and Cookie Notice WordPress Plugin – FooBar ≤ 2.1.34
fullworks Anti-Spam Protection – No API Key, GDPR Friendly ≤ 2.3.7
hasanazizul Text To Speech TTS Accessibility ≤ 1.7.34
hkdigitalagency Payment Gateway for ACBA BANK ≤ 1.2.6
inavii Inavii Social Feed ≤ 2.7.0
infosatech RevivePress – Keep your Old Content Evergreen ≤ 1.5.8
interactivegeomaps MapGeo – Interactive Geo Maps ≤ 1.6.22
josevega Disable Payment Methods based on cart conditions for WooCommerce ≤ 1.16.3
josevega WP Page Templates ≤ 1.1.16
kaira StoreCustomizer – A plugin to Customize all WooCommerce Pages ≤ 2.5.9
kaizencoders URL Shortify – Simple and Easy URL Shortener ≤ 1.10.4
kofimokome Message Filter for Contact Form 7 ≤ 1.6.3.2
litonice13 Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits ≤ 2.0.7.2
mapster Mapster WP Maps ≤ 1.9.0
meowcrew Role Based Pricing for Woo by Meow Crew ≤ 1.6.0
mhmrajib TopNewsWp – Display Tikcer News, RSS Feed Widget and Many More ≤ 2.4.1
mihail-barinov Share This Image ≤ 2.07
mr2p Meta Field Block – Display custom fields in the Block Editor without coding ≤ 1.3.3
mte90 Glossary ≤ 2.2.38
nicheaddons Events Addon for Elementor ≤ 2.2.2
nicheaddons Primary Addon for Elementor ≤ 1.6.0
nicheaddons Restaurant & Cafe Addon for Elementor ≤ 1.5.8
nitin247 Place Order Without Payment for WooCommerce ≤ 2.6.5
oceanwp Ocean Extra ≤ 2.4.2
oxilab Product Layouts for WooCommerce ≤ 1.3.1
pagup Automatic Internal Links for SEO by Pagup ≤ 2.0.0
pagup Bulk Auto Image Alt Text (Alt tag, Alt attribute) optimizer (image SEO) ≤ 2.1.0
paretodigital Embedder for Google Reviews ≤ 1.6.6
paretodigital Send Users Email – Email Subscribers, Email Marketing Newsletter ≤ 1.5.10
passionatebrains GA4WP – Analytics Dashboard for the Website ≤ 2.6.0
peterschulznl Code Manager ≤ 1.0.40
plugins360 Automatic YouTube Gallery ≤ 2.5.5
pluginscafe Smart phone field for Gravity Forms ≤ 2.1.6
prasadkirpekar WP Meta and Date Remover ≤ 2.3.4
premmerce Premmerce Permalink Manager for WooCommerce ≤ 2.3.11
princeahmed Dracula Dark Mode – Accessibility, Reading Mode & Dark Mode for WordPress ≤ 1.2.7
princeahmed File Manager for Google Drive – Integrate Google Drive ≤ 1.4.9
princeahmed Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player ≤ 2.0.82
rebelcode Spotlight Social Feeds – Block, Shortcode, and Widget ≤ 1.7.0
samdani Team Members – A WordPress Team Plugin with Gallery, Grid, Carousel, Slider, Table, List, and More ≤ 2.5.8
sebet Go Fetch Jobs (for WP Job Manager) ≤ 1.8.4.8.1
seezee Five-Star Ratings Shortcode ≤ 1.2.56
senols AI Puffer – Chat. Create. Automate. (formerly AI Power) ≤ 1.8.99
smartwpress Music Player for Elementor – Audio Player & Podcast Player ≤ 2.4.1
spicethemes Carousel, Recent Post Slider and Banner Slider ≤ 2.1
spiderdevs EazyDocs – AI Powered Knowledge Base, Wiki, Documentation & FAQ Builder ≤ 2.5.7
spiderdevs Forumax – AI Powered Advanced Community Forum Plugin ≤ 1.2.7
streamweasels StreamWeasels Twitch Integration ≤ 1.9.2
themelocation Custom WooCommerce Checkout Fields Editor ≤ 1.3.4
themelocation Remove Add to Cart WooCommerce ≤ 1.4.7
tickera Restrict – membership, site, content and user access restrictions for WordPress ≤ 2.3.0
tobias_conrad WOW Styler for CF7 – Visual Styler for Contact Form 7 Forms ≤ 1.7.0
toddhalfpenny Widgets on Pages ≤ 1.7
tonyzeoli Radio Station by netmix® – Manage and play your Show Schedule in WordPress! ≤ 2.5.9
unitecms Unlimited Elements For Elementor ≤ 1.5.140
uriahs-victor Kikote – Location Picker at Checkout & Google Address AutoFill Plugin for WooCommerce ≤ 1.10.6
webfactory AI Bud – AI Content Generator, AI Chatbot, ChatGPT, Gemini, GPT-4o ≤ 1.7.2
wordplus Better Messages – Live Chat, Chat Rooms, Real-Time Messaging & Private Messages ≤ 2.6.7
wpbits WPBITS Addons For Elementor Page Builder ≤ 1.7
wpdever WP Notification Bell ≤ 1.4.2
wpjoli Joli Table Of Contents ≤ 2.6.0
wpsaad Image Alt Text Manager – Bulk & Dynamic Alt Tags For image SEO Optimization + AI ≤ 1.6.3
xplodedthemes XT Quick View for WooCommerce ≤ 2.1.5
xplodedthemes XT Variation Swatches for WooCommerce ≤ 1.9.4
yuvalo Goal Tracker – Custom Event Tracking for GA4 ≤ 1.1.5

Referencias y parches

CVE recientes del mismo producto — WordPress plugins & themes