CVE-2024-13362: Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient…

PriorityP425medium6.1CVSS 3.1

AVNACLPRNUIRSCCLILAN

EPSS

0.28%

19.4th percentile

Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Affected

101 ranges· showing 25

Vendor	Product	Version range	Fixed in
100plugins	open_user_map	<= 1.4.0	—
5starplugins	dynamic_copyright_year	<= 1.0.4	—
5starplugins	easy_age_verify	<= 1.8.5	—
5starplugins	featured_images_in_rss_for_mailchimp_more	<= 1.6.3	—
5starplugins	marijuana_age_verify	<= 1.5.5	—
bensibley	independent_analytics	<= 2.9.7	—
blackandwhitedigital	treepress_easy_family_trees_ancestor_profiles	<= 3.0.6	—
bouncingsprout	ultimeter	<= 3.0.5	—
bplugins	advanced_scrollbar_custom_scrollbar_styling_and_behavior	<= 1.1.3	—
bplugins	bblocks_essential_gutenberg_blocks_patterns_collection	<= 1.9.8	—
bplugins	pdf_poster_display_pdf_files_with_custom_viewer	<= 2.2.0	—
cleverplugins	security_ninja_wordpress_security_firewall	<= 5.222	—
codesavory	knowledge_base_documentation_wiki_plugin_basepress_docs	<= 2.16.3.3	—
cyberhobo	geo_mashup	<= 1.13.15	—
cyclonecode	custom_php_settings	<= 2.3.1	—
damian-gora	justified_gallery	<= 1.9.0	—
dashlabsltd	yasr_yet_another_star_rating_plugin_for_wordpress	<= 3.4.12	—
davidanderson	internal_link_juicer_seo_auto_linker_for_wordpress	<= 2.24.6	—
elliotvs	coupon_affiliates_affiliate_plugin_for_woocommerce	<= 5.17.2	—
enweby	full_screen_background	<= 2.0.2	—
fooplugins	gallery_by_foogallery	<= 2.4.27	—
fooplugins	lightbox_modal_popup_wordpress_plugin_foobox	<= 2.7.33	—
fullworks	display_eventbrite_events	<= 6.1.10	—
gallerycreator	mixed_media_gallery_blocks	<= 3.2.4.4	—
gn_themes	wp_shortcodes_plugin_shortcodes_ultimate	<= 7.3.3	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.