CVE-2024-13362
Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
100plugins · Open User Map5starplugins · Dynamic Copyright Year5starplugins · Easy Age Verify5starplugins · Featured Images in RSS for Mailchimp & More5starplugins · Marijuana Age Verifyafthemes · WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatarsbensibley · Independent Analyticsblackandwhitedigital · TreePress – Easy Family Trees & Ancestor Profilesblockspare · BlockSpare — News, Magazine and Blog Addons for (Gutenberg) Block Editorbouncingsprout · Ultimeterbplugins · Advanced Scrollbar – Custom Scrollbar Styling and Behaviorbplugins · bBlocks – Essential Gutenberg Blocks & Patterns Collectionbplugins · HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Playerbplugins · PDF Poster – Display PDF Files with Custom Viewercleverplugins · Security Ninja – WordPress Security & Firewallcodesavory · Knowledge Base documentation & wiki plugin – BasePress Docscyberhobo · Geo Mashupcyclonecode · Custom PHP Settingsdamian-gora · Justified Gallerydashlabsltd · YASR – Yet Another Star Rating Plugin for WordPressdavidanderson · Internal Link Juicer: SEO Auto Linker for WordPresselespare · EleSpare – News, Magazine and Blog Addons for Elementorelliotvs · Coupon Affiliates – Affiliate Plugin for WooCommerceenweby · Full Screen Backgroundessekia · Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluentfooplugins · Gallery by FooGalleryfooplugins · Lightbox & Modal Popup WordPress Plugin – FooBoxfooplugins · Notification Bar, Announcement and Cookie Notice WordPress Plugin – FooBarfullworks · Anti-Spam Protection – No API Key, GDPR Friendlyfullworks · Display Eventbrite Eventsgallerycreator · Mixed Media Gallery Blocksgn_themes · WP Shortcodes Plugin — Shortcodes Ultimategowebsmarty · WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scanhasanazizul · Text To Speech TTS Accessibilityhkdigitalagency · Payment Gateway for ACBA BANKimtiazrayhan · WP Coupons and Deals – Coupon Plugin For Affiliate Marketersinavii · Inavii Social Feedinfornweb · Blog Designer Pack – Blog, Post Grid, Post Slider, Post Carousel, Category Post, Newsinfornweb · Logo Showcase – Responsive Logo Carousel, Logo Slider & Logo Gridinfornweb · Post List Designer – Category Post, Recent Post, Post Listinfosatech · RevivePress – Keep your Old Content Evergreeninteractivegeomaps · MapGeo – Interactive Geo Mapsinvisnet · WP fail2ban – Advanced Securityjosevega · Bulk Edit Posts and Products in Spreadsheetjosevega · Disable Payment Methods based on cart conditions for WooCommercejosevega · WP Page Templateskaira · StoreCustomizer – A plugin to Customize all WooCommerce Pageskaizencoders · URL Shortify – Simple and Easy URL Shortenerkoen12344 · Post to Google My Business (Google Business Profile)kofimokome · Message Filter for Contact Form 7litonice13 · Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kitsmapster · Mapster WP Mapsmattpramschufer · Pay For Post with WooCommercemeowcrew · Role Based Pricing for Woo by Meow Crewmhmrajib · AidWP – Donation & Payment Forms (Stripe Powered)mhmrajib · TopNewsWp – Display Tikcer News, RSS Feed Widget and Many Moremhmrajib · WP Books Gallery – Build Stunning Book Showcases & Libraries in Minutesmihail-barinov · Share This Imagemikewire_rocksolid · Announcement & Notification Banner – Bulletinmohsinoffline · Secure Gateway for Authorize.net and WooCommerce by Pledged Pluginsmr2p · Meta Field Block – Display custom fields in the Block Editor without codingmte90 · Glossarynicheaddons · Events Addon for Elementornicheaddons · Primary Addon for Elementornicheaddons · Restaurant & Cafe Addon for Elementornitin247 · Place Order Without Payment for WooCommercenitin247 · Thank You Page for WooCommerceoceanwp · Ocean Extraoxilab · Product Layouts for WooCommercepagup · Automatic Internal Links for SEO by Paguppagup · Bulk Auto Image Alt Text (Alt tag, Alt attribute) optimizer (image SEO)paretodigital · Embedder for Google Reviewsparetodigital · Send Users Email – Email Subscribers, Email Marketing Newsletterpassionatebrains · AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading & Image Optimizationpassionatebrains · AWCA – The Great Analytics Insights for Your eStorepassionatebrains · GA4WP – Analytics Dashboard for the Websitepeterschulznl · Code Managerpeterschulznl · WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboardspluginandplay · Post Slider and Post Carousel with Post Vertical Scrolling Widget – A Responsive Post Sliderplugins360 · Automatic YouTube Gallerypluginscafe · Smart phone field for Gravity Formspluginsware · Advanced Classifieds & Directory Proprasadkirpekar · WP Meta and Date Removerpremmerce · Premmerce Permalink Manager for WooCommercepremmerce · Premmerce Product Filter for WooCommerceprinceahmed · Dracula Dark Mode – Accessibility, Reading Mode & Dark Mode for WordPressprinceahmed · File Manager for Google Drive – Integrate Google Driveprinceahmed · Radio Player – Live Shoutcast, Icecast and Any Audio Stream Playerrebelcode · Spotlight Social Feeds – Block, Shortcode, and Widgetsaadiqbal · Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile Appsamdani · Solid Testimonials – Testimonial Slider, Video Testimonials & Customer Reviewssamdani · Team Members – A WordPress Team Plugin with Gallery, Grid, Carousel, Slider, Table, List, and Moresebet · Go Fetch Jobs (for WP Job Manager)seezee · Five-Star Ratings Shortcodesenols · AI Puffer – Chat. Create. Automate. (formerly AI Power)sjaved · Easy Social Feed – Social Photos Gallery and Post Feed for WordPresssmartwpress · Music Player for Elementor – Audio Player & Podcast Playerspeedify · Auto-Install Free SSL – Generate & Install Free SSL Certificatesspicethemes · Carousel, Recent Post Slider and Banner Sliderspiderdevs · EazyDocs – AI Powered Knowledge Base, Wiki, Documentation & FAQ Builderspiderdevs · Forumax – AI Powered Advanced Community Forum Pluginstreamweasels · StreamWeasels Twitch Integrationtakanakui · Menu Image, Icons made easytakanakui · WP Mobile Menu – The Mobile-Friendly Responsive Menutheafricanboss · Checkout with Cash App on WooCommercethemelocation · Custom WooCommerce Checkout Fields Editorthemelocation · Remove Add to Cart WooCommercetickera · Restrict – membership, site, content and user access restrictions for WordPresstobiasbg · TablePress – Tables in WordPress made easytobias_conrad · WOW Styler for CF7 – Visual Styler for Contact Form 7 Formstoddhalfpenny · Widgets on Pagestonyzeoli · Radio Station by netmix® – Manage and play your Show Schedule in WordPress!tripetto · WordPress form builder plugin for contact forms, surveys and quizzes – Tripettounitecms · Unlimited Elements For Elementoruriahs-victor · Kikote – Location Picker at Checkout & Google Address AutoFill Plugin for WooCommercevinod-dalvi · Ivory Search – WordPress Search Pluginwebba-agency · Easy Appointment Booking & Scheduling System – Webba Booking Calendarwebfactory · AI Bud – AI Content Generator, AI Chatbot, ChatGPT, Gemini, GPT-4owebheadllc · Contact Form 7 Multi-Step Formswordplus · Better Messages – Live Chat, Chat Rooms, Real-Time Messaging & Private Messageswpbits · WPBITS Addons For Elementor Page Builderwpdever · WP Notification Bellwpjoli · Joli Table Of Contentswpmagics · Delete Posts automaticallywpsaad · Image Alt Text Manager – Bulk & Dynamic Alt Tags For image SEO Optimization + AIwpspeedo · Team Members Showcasexplodedthemes · WPIDE – File Manager & Code Editorxplodedthemes · XT Floating Cart for WooCommercexplodedthemes · XT Quick View for WooCommercexplodedthemes · XT Variation Swatches for WooCommerceyuvalo · Goal Tracker – Custom Event Tracking for GA4Quer saber se a sua infraestrutura está exposta a isto?
Falar com a TrueHacking →Referências
https://plugins.trac.wordpress.org/browser/add-search-to-menu/trunk/includes/freemius/assets/js/pricing/freemius-pricing.jshttps://plugins.trac.wordpress.org/browser/featured-images-for-rss-feeds/trunk/includes/freemius/assets/js/pricing/freemius-pricing.jshttps://plugins.trac.wordpress.org/browser/foobox-image-lightbox/tags/2.7.33/freemius/assets/js/pricing/freemius-pricing.jshttps://plugins.trac.wordpress.org/browser/foogallery/tags/2.4.27/freemius/assets/js/pricing/freemius-pricing.jshttps://plugins.trac.wordpress.org/browser/independent-analytics/trunk/freemius/assets/js/pricing/freemius-pricing.jshttps://plugins.trac.wordpress.org/browser/interactive-geo-maps/tags/1.6.21/vendor/freemius/wordpress-sdk/assets/js/pricing/freemius-pricing.jshttps://plugins.trac.wordpress.org/browser/internal-links/trunk/vendor/freemius/wordpress-sdk/assets/js/pricing/freemius-pricing.jshttps://plugins.trac.wordpress.org/browser/master-addons/trunk/lib/freemius/assets/js/pricing/freemius-pricing.jshttps://plugins.trac.wordpress.org/browser/menu-image/trunk/freemius/assets/js/pricing/freemius-pricing.jshttps://plugins.trac.wordpress.org/browser/ocean-extra/trunk/includes/freemius/assets/js/pricing/freemius-pricing.jshttps://plugins.trac.wordpress.org/browser/pdf-poster/trunk/freemius/assets/js/pricing/freemius-pricing.jshttps://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/freemius/assets/js/pricing/freemius-pricing.js