Medium severity · published May 1, 2026
CVE-2024-13362
Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AB
AI Bud – AI Content Generator, AI Chatbot, ChatGPT, Gemini, GPT-4o · webfactory
through 1.7.2 · source: vendor
AP
AI Puffer – Chat. Create. Automate. (formerly AI Power) · senols
through 1.8.99 · source: vendor
AS
Advanced Scrollbar – Custom Scrollbar Styling and Behavior · bplugins
through 1.1.3 · source: vendor
AI
Automatic Internal Links for SEO by Pagup · pagup
through 2.0.0 · source: vendor
BA
Bulk Auto Image Alt Text (Alt tag, Alt attribute) optimizer (image SEO) · pagup
through 2.1.0 · source: vendor
CR
Carousel, Recent Post Slider and Banner Slider · spicethemes
through 2.1 · source: vendor
CM
Code Manager · peterschulznl
through 1.0.40 · source: vendor
CW
Custom WooCommerce Checkout Fields Editor · themelocation
through 1.3.4 · source: vendor
DP
Disable Payment Methods based on cart conditions for WooCommerce · josevega
through 1.16.3 · source: vendor
DD
Dracula Dark Mode – Accessibility, Reading Mode & Dark Mode for WordPress · princeahmed
through 1.2.7 · source: vendor
DC
Dynamic Copyright Year · 5starplugins
through 1.0.4 · source: vendor
EA
Easy Age Verify · 5starplugins
through 1.8.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-13362
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-13362
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/add-search-to-menu/trunk/includes/freemius/assets/js/pricing/freemius-pricing.js
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/featured-images-for-rss-feeds/trunk/includes/freemius/assets/js/pricing/freemius-pricing.js
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/foobox-image-lightbox/tags/2.7.33/freemius/assets/js/pricing/freemius-pricing.js
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/foogallery/tags/2.4.27/freemius/assets/js/pricing/freemius-pricing.js
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/independent-analytics/trunk/freemius/assets/js/pricing/freemius-pricing.js
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/interactive-geo-maps/tags/1.6.21/vendor/freemius/wordpress-sdk/assets/js/pricing/freemius-pricing.js
More from Open User Map
7.1
CVE-2026-84818
WordPress Open User Map plugin <= 1.4.50 - Cross Site Scripting (XSS) vulnerability
6.5
CVE-2026-66445
WordPress Open User Map plugin <= 1.4.46 - Cross Site Scripting (XSS) vulnerability
4.8
CVE-2023-45056
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in 100plugins Open User Map plugin <= 1.3.26 versions