Log in Start free

Vulnerability · Published May 1, 2026 · Assigned by Wordfence

CVE-2024-13362Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter

Medium 6.1

In plain English

A medium-severity cross-site scripting in Open User Map from 100plugins. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.3%top 79.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Affected products (as reported)

VendorProductVersions
sebet Go Fetch Jobs (for WP Job Manager) 0 – through 1.8.4.8.1
5starplugins Dynamic Copyright Year 0 – through 1.0.4
peterschulznl Code Manager 0 – through 1.0.40
bplugins Advanced Scrollbar – Custom Scrollbar Styling and Behavior 0 – through 1.1.3
yuvalo Goal Tracker – Custom Event Tracking for GA4 0 – through 1.1.5
essekia Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent 0 – through 1.1.13
josevega WP Page Templates 0 – through 1.1.16
hkdigitalagency Payment Gateway for ACBA BANK 0 – through 1.2.6
princeahmed Dracula Dark Mode – Accessibility, Reading Mode & Dark Mode for WordPress 0 – through 1.2.7
spiderdevs Forumax – AI Powered Advanced Community Forum Plugin 0 – through 1.2.7
seezee Five-Star Ratings Shortcode 0 – through 1.2.56
oxilab Product Layouts for WooCommerce 0 – through 1.3.1
mr2p Meta Field Block – Display custom fields in the Block Editor without coding 0 – through 1.3.3
themelocation Custom WooCommerce Checkout Fields Editor 0 – through 1.3.4
100plugins Open User Map 0 – through 1.4.0
wpdever WP Notification Bell 0 – through 1.4.2
themelocation Remove Add to Cart WooCommerce 0 – through 1.4.7
princeahmed File Manager for Google Drive – Integrate Google Drive 0 – through 1.4.9
5starplugins Marijuana Age Verify 0 – through 1.5.5
infosatech RevivePress – Keep your Old Content Evergreen 0 – through 1.5.8
nicheaddons Restaurant & Cafe Addon for Elementor 0 – through 1.5.8
paretodigital Send Users Email – Email Subscribers, Email Marketing Newsletter 0 – through 1.5.10
unitecms Unlimited Elements For Elementor 0 – through 1.5.140
meowcrew Role Based Pricing for Woo by Meow Crew 0 – through 1.6.0
nicheaddons Primary Addon for Elementor 0 – through 1.6.0
5starplugins Featured Images in RSS for Mailchimp & More 0 – through 1.6.3
wpsaad Image Alt Text Manager – Bulk & Dynamic Alt Tags For image SEO Optimization + AI 0 – through 1.6.3
kofimokome Message Filter for Contact Form 7 0 – through 1.6.3.2
paretodigital Embedder for Google Reviews 0 – through 1.6.6
interactivegeomaps MapGeo – Interactive Geo Maps 0 – through 1.6.22

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References