CVE-2024-13362
Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
Description
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
No summary for this CVE yet.
CVSS Vector Breakdown
Exploitability
AV:NAttack VectorNetwork
AC:LAttack ComplexityLow
PR:NPrivileges RequiredNone
UI:RUser InteractionRequired
Scope
S:CScopeChanged
Impact
C:LConfidentialityLow
I:LIntegrityLow
A:NAvailabilityNone
Weaknesses
Affected Products
5starplugins
commercial
bplugins
commercialaka button block, bplugins html5 video player, bslider
xplodedthemes
commercialaka xploded themes
josevega
aka josevega woocommerce plugin author
princeahmed
aka icecast and any audio stream player, wp radio, radio player – live shoutcast, file manager for google drive – integrate google drive, icecast
nicheaddons
commercialaka restaurant & cafe addon for elementor, primary addon for elementor, events addon for elementor
and 110 more affected products View all →
Exploitability
No known exploits, KEV entries, or remediation guidance available for this vulnerability yet.
Attack Graph
Products CVE Techniques Tactics
Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.
MITRE ATT&CK
2 techniques Execution
Initial Access
References
https://www.wordfence.com/threat-intel/vulnerabilities/id/d694491c-c0f5-4418-805a-db792ea4f712?source=cve
wordfence.com
https://plugins.trac.wordpress.org/browser/tablepress/trunk/libraries/freemius/assets/js/pricing/freemius-pricing.js
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/widgets-on-pages/trunk/freemius/assets/js/pricing/freemius-pricing.js
plugins.trac.wordpress.org
and 21 more references View all →
Unlock Complete Vulnerability Intelligence
Get the full picture for CVE-2024-13362 and every CVE in our database. Create a free account — no credit card required.
Create Free AccountPlain-language analysis
Impact assessment and exploitation scenario in plain English
Attack graph visualization
Interactive attack path and kill chain mapping
Exploit details & PoC links
ExploitDB, Metasploit, GitHub PoCs with direct links
Nuclei scanner templates
Ready-to-use vulnerability scanner templates
Full remediation guide
Patch instructions, workarounds, and compliance impact
Interactive AI chat
Ask questions about this vulnerability in natural language
Related vulnerabilities
Semantically similar CVEs and attack patterns
REST API & MCP access
Integrate vulnerability data into your workflows