CVE-2024-13362

Friday, May 01, 2026

6.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Affected Software

Vendor	Product	Version Range	Status
sebet	Go Fetch Jobs (for WP Job Manager)	`0 <= 1.8.4.8.1`	affected
5starplugins	Dynamic Copyright Year	`0 <= 1.0.4`	affected
peterschulznl	Code Manager	`0 <= 1.0.40`	affected
bplugins	Advanced Scrollbar – Custom Scrollbar Styling and Behavior	`0 <= 1.1.3`	affected
yuvalo	Goal Tracker – Custom Event Tracking for GA4	`0 <= 1.1.5`	affected
essekia	Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent	`0 <= 1.1.13`	affected
josevega	WP Page Templates	`0 <= 1.1.16`	affected
hkdigitalagency	Payment Gateway for ACBA BANK	`0 <= 1.2.6`	affected
princeahmed	Dracula Dark Mode – Accessibility, Reading Mode & Dark Mode for WordPress	`0 <= 1.2.7`	affected
spiderdevs	Forumax – AI Powered Advanced Community Forum Plugin	`0 <= 1.2.7`	affected
seezee	Five-Star Ratings Shortcode	`0 <= 1.2.56`	affected
oxilab	Product Layouts for WooCommerce	`0 <= 1.3.1`	affected
mr2p	Meta Field Block – Display custom fields in the Block Editor without coding	`0 <= 1.3.3`	affected
themelocation	Custom WooCommerce Checkout Fields Editor	`0 <= 1.3.4`	affected
100plugins	Open User Map	`0 <= 1.4.0`	affected
wpdever	WP Notification Bell	`0 <= 1.4.2`	affected
themelocation	Remove Add to Cart WooCommerce	`0 <= 1.4.7`	affected
princeahmed	File Manager for Google Drive – Integrate Google Drive	`0 <= 1.4.9`	affected
5starplugins	Marijuana Age Verify	`0 <= 1.5.5`	affected
infosatech	RevivePress – Keep your Old Content Evergreen	`0 <= 1.5.8`	affected
nicheaddons	Restaurant & Cafe Addon for Elementor	`0 <= 1.5.8`	affected
paretodigital	Send Users Email – Email Subscribers, Email Marketing Newsletter	`0 <= 1.5.10`	affected
unitecms	Unlimited Elements For Elementor	`0 <= 1.5.140`	affected
meowcrew	Role Based Pricing for Woo by Meow Crew	`0 <= 1.6.0`	affected
nicheaddons	Primary Addon for Elementor	`0 <= 1.6.0`	affected
5starplugins	Featured Images in RSS for Mailchimp & More	`0 <= 1.6.3`	affected
wpsaad	Image Alt Text Manager – Bulk & Dynamic Alt Tags For image SEO Optimization + AI	`0 <= 1.6.3`	affected
kofimokome	Message Filter for Contact Form 7	`0 <= 1.6.3.2`	affected
paretodigital	Embedder for Google Reviews	`0 <= 1.6.6`	affected
interactivegeomaps	MapGeo – Interactive Geo Maps	`0 <= 1.6.22`	affected
wpbits	WPBITS Addons For Elementor Page Builder	`0 <= 1.7`	affected
toddhalfpenny	Widgets on Pages	`0 <= 1.7`	affected
rebelcode	Spotlight Social Feeds – Block, Shortcode, and Widget	`0 <= 1.7.0`	affected
tobias_conrad	WOW Styler for CF7 – Visual Styler for Contact Form 7 Forms	`0 <= 1.7.0`	affected
webfactory	AI Bud – AI Content Generator, AI Chatbot, ChatGPT, Gemini, GPT-4o	`0 <= 1.7.2`	affected
hasanazizul	Text To Speech TTS Accessibility	`0 <= 1.7.34`	affected
5starplugins	Easy Age Verify	`0 <= 1.8.5`	affected
senols	AI Puffer – Chat. Create. Automate. (formerly AI Power)	`0 <= 1.8.99`	affected
damian-gora	Justified Gallery	`0 <= 1.9.0`	affected
mapster	Mapster WP Maps	`0 <= 1.9.0`	affected
streamweasels	StreamWeasels Twitch Integration	`0 <= 1.9.2`	affected
xplodedthemes	XT Variation Swatches for WooCommerce	`0 <= 1.9.4`	affected
bplugins	bBlocks – Essential Gutenberg Blocks & Patterns Collection	`0 <= 1.9.8`	affected
kaizencoders	URL Shortify – Simple and Easy URL Shortener	`0 <= 1.10.4`	affected
uriahs-victor	Kikote – Location Picker at Checkout & Google Address AutoFill Plugin for WooCommerce	`0 <= 1.10.6`	affected
cyberhobo	Geo Mashup	`0 <= 1.13.15`	affected
josevega	Disable Payment Methods based on cart conditions for WooCommerce	`0 <= 1.16.3`	affected
pagup	Automatic Internal Links for SEO by Pagup	`0 <= 2.0.0`	affected
enweby	Full Screen Background	`0 <= 2.0.2`	affected
litonice13	Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits	`0 <= 2.0.7.2`	affected
princeahmed	Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player	`0 <= 2.0.82`	affected
spicethemes	Carousel, Recent Post Slider and Banner Slider	`0 <= 2.1`	affected
pagup	Bulk Auto Image Alt Text (Alt tag, Alt attribute) optimizer (image SEO)	`0 <= 2.1.0`	affected
xplodedthemes	XT Quick View for WooCommerce	`0 <= 2.1.5`	affected
pluginscafe	Smart phone field for Gravity Forms	`0 <= 2.1.6`	affected
fooplugins	Notification Bar, Announcement and Cookie Notice WordPress Plugin – FooBar	`0 <= 2.1.34`	affected
bplugins	PDF Poster – Display PDF Files with Custom Viewer	`0 <= 2.2.0`	affected
nicheaddons	Events Addon for Elementor	`0 <= 2.2.2`	affected
bplugins	HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player	`0 <= 2.2.27`	affected
mte90	Glossary	`0 <= 2.2.38`	affected
tickera	Restrict – membership, site, content and user access restrictions for WordPress	`0 <= 2.3.0`	affected
cyclonecode	Custom PHP Settings	`0 <= 2.3.1`	affected
prasadkirpekar	WP Meta and Date Remover	`0 <= 2.3.4`	affected
fullworks	Anti-Spam Protection – No API Key, GDPR Friendly	`0 <= 2.3.7`	affected
premmerce	Premmerce Permalink Manager for WooCommerce	`0 <= 2.3.11`	affected
smartwpress	Music Player for Elementor – Audio Player & Podcast Player	`0 <= 2.4.1`	affected
mhmrajib	TopNewsWp – Display Tikcer News, RSS Feed Widget and Many More	`0 <= 2.4.1`	affected
oceanwp	Ocean Extra	`0 <= 2.4.2`	affected
fooplugins	Gallery by FooGallery	`0 <= 2.4.27`	affected
plugins360	Automatic YouTube Gallery	`0 <= 2.5.5`	affected
spiderdevs	EazyDocs – AI Powered Knowledge Base, Wiki, Documentation & FAQ Builder	`0 <= 2.5.7`	affected
samdani	Team Members – A WordPress Team Plugin with Gallery, Grid, Carousel, Slider, Table, List, and More	`0 <= 2.5.8`	affected
tonyzeoli	Radio Station by netmix® – Manage and play your Show Schedule in WordPress!	`0 <= 2.5.9`	affected
kaira	StoreCustomizer – A plugin to Customize all WooCommerce Pages	`0 <= 2.5.9`	affected
wpjoli	Joli Table Of Contents	`0 <= 2.6.0`	affected
passionatebrains	GA4WP – Analytics Dashboard for the Website	`0 <= 2.6.0`	affected
nitin247	Place Order Without Payment for WooCommerce	`0 <= 2.6.5`	affected
wordplus	Better Messages – Live Chat, Chat Rooms, Real-Time Messaging & Private Messages	`0 <= 2.6.7`	affected
mihail-barinov	Share This Image	`0 <= 2.07`	affected
inavii	Inavii Social Feed	`0 <= 2.7.0`	affected
fooplugins	Lightbox & Modal Popup WordPress Plugin – FooBox	`0 <= 2.7.33`	affected
xplodedthemes	XT Floating Cart for WooCommerce	`0 <= 2.8.4`	affected
takanakui	WP Mobile Menu – The Mobile-Friendly Responsive Menu	`0 <= 2.8.6`	affected
passionatebrains	AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading & Image Optimization	`0 <= 2.9.2`	affected
bensibley	Independent Analytics	`0 <= 2.9.7`	affected
codesavory	Knowledge Base documentation & wiki plugin – BasePress Docs	`0 <= 2.16.3.3`	affected
davidanderson	Internal Link Juicer: SEO Auto Linker for WordPress	`0 <= 2.24.6`	affected
josevega	Bulk Edit Posts and Products in Spreadsheet	`0 <= 2.25.16`	affected
saadiqbal	Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App	`0 <= 3.0.0`	affected
tobiasbg	TablePress – Tables in WordPress made easy	`0 <= 3.0.2`	affected
bouncingsprout	Ultimeter	`0 <= 3.0.5`	affected
blackandwhitedigital	TreePress – Easy Family Trees & Ancestor Profiles	`0 <= 3.0.6`	affected
mattpramschufer	Pay For Post with WooCommerce	`0 <= 3.1.26`	affected
koen12344	Post to Google My Business (Google Business Profile)	`0 <= 3.1.28`	affected
imtiazrayhan	WP Coupons and Deals – Coupon Plugin For Affiliate Marketers	`0 <= 3.2.2`	affected
pluginsware	Advanced Classifieds & Directory Pro	`0 <= 3.2.4`	affected
gallerycreator	Mixed Media Gallery Blocks	`0 <= 3.2.4.4`	affected
blockspare	BlockSpare — News, Magazine and Blog Addons for (Gutenberg) Block Editor	`0 <= 3.2.6`	affected
mhmrajib	AidWP – Donation & Payment Forms (Stripe Powered)	`0 <= 3.2.6`	affected
infornweb	Logo Showcase – Responsive Logo Carousel, Logo Slider & Logo Grid	`0 <= 3.2.7`	affected
pluginandplay	Post Slider and Post Carousel with Post Vertical Scrolling Widget – A Responsive Post Slider	`0 <= 3.2.7`	affected
samdani	Solid Testimonials – Testimonial Slider, Video Testimonials & Customer Reviews	`0 <= 3.2.8`	affected
wpspeedo	Team Members Showcase	`0 <= 3.3.0`	affected
elespare	EleSpare – News, Magazine and Blog Addons for Elementor	`0 <= 3.3.2`	affected
infornweb	Post List Designer – Category Post, Recent Post, Post List	`0 <= 3.3.7`	affected
infornweb	Blog Designer Pack – Blog, Post Grid, Post Slider, Post Carousel, Category Post, News	`0 <= 3.4.9`	affected
dashlabsltd	YASR – Yet Another Star Rating Plugin for WordPress	`0 <= 3.4.12`	affected
xplodedthemes	WPIDE – File Manager & Code Editor	`0 <= 3.5.1`	affected
premmerce	Premmerce Product Filter for WooCommerce	`0 <= 3.7.3`	affected
afthemes	WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars	`0 <= 3.8.3`	affected
wpmagics	Delete Posts automatically	`0 <= 3.9.6`	affected
takanakui	Menu Image, Icons made easy	`0 <= 3.12`	affected
passionatebrains	AWCA – The Great Analytics Insights for Your eStore	`0 <= 3.12.0`	affected
mikewire_rocksolid	Announcement & Notification Banner – Bulletin	`0 <= 3.12.1`	affected
nitin247	Thank You Page for WooCommerce	`0 <= 4.2.0`	affected
webheadllc	Contact Form 7 Multi-Step Forms	`0 <= 4.4.1`	affected
speedify	Auto-Install Free SSL – Generate & Install Free SSL Certificates	`0 <= 4.5.0`	affected
mhmrajib	WP Books Gallery – Build Stunning Book Showcases & Libraries in Minutes	`0 <= 4.6.8`	affected
webba-agency	Easy Appointment Booking & Scheduling System – Webba Booking Calendar	`0 <= 5.0.57`	affected
invisnet	WP fail2ban – Advanced Security	`0 <= 5.3.4`	affected
vinod-dalvi	Ivory Search – WordPress Search Plugin	`0 <= 5.5.8`	affected
peterschulznl	WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards	`0 <= 5.5.31`	affected
elliotvs	Coupon Affiliates – Affiliate Plugin for WooCommerce	`0 <= 5.17.2`	affected
cleverplugins	Security Ninja – WordPress Security & Firewall	`0 <= 5.222`	affected
theafricanboss	Checkout with Cash App on WooCommerce	`0 <= 6.0.2`	affected
fullworks	Display Eventbrite Events	`0 <= 6.1.10`	affected
mohsinoffline	Secure Gateway for Authorize.net and WooCommerce by Pledged Plugins	`0 <= 6.1.13`	affected
sjaved	Easy Social Feed – Social Photos Gallery and Post Feed for WordPress	`0 <= 6.6.5`	affected
gn_themes	WP Shortcodes Plugin — Shortcodes Ultimate	`0 <= 7.3.3`	affected
gowebsmarty	WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan	`0 <= 7.7.0`	affected
tripetto	WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto	`0 <= 8.0.7`	affected

Weaknesses

CWE-79: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

ADP Enrichment

CISA ADP Vulnrichment

SSVC:
Exploitation: none
- Automatable: no
- Technical Impact: partial

References

Feedback

Was this page helpful?

Glad to hear it! Please tell us how we can improve.

Sorry to hear that. Please tell us how we can improve.