CVE record · CVE-2024-13362

Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter

CVSS 6.1 MediumEPSS 0.0028 · 20th percentile

Published by the CVE Program (CNA: Wordfence) at 1 May 2026, 05:29 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
sebet	Go Fetch Jobs (for WP Job Manager)	affected 1.8.4.8.1 and earlier semver Other versions: unaffected
5starplugins	Dynamic Copyright Year	affected 1.0.4 and earlier semver Other versions: unaffected
peterschulznl	Code Manager	affected 1.0.40 and earlier semver Other versions: unaffected
bplugins	Advanced Scrollbar – Custom Scrollbar Styling and Behavior	affected 1.1.3 and earlier semver Other versions: unaffected
yuvalo	Goal Tracker – Custom Event Tracking for GA4	affected 1.1.5 and earlier semver Other versions: unaffected
essekia	Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent	affected 1.1.13 and earlier semver Other versions: unaffected
josevega	WP Page Templates	affected 1.1.16 and earlier semver Other versions: unaffected
hkdigitalagency	Payment Gateway for ACBA BANK	affected 1.2.6 and earlier semver Other versions: unaffected
princeahmed	Dracula Dark Mode – Accessibility, Reading Mode & Dark Mode for WordPress	affected 1.2.7 and earlier semver Other versions: unaffected
spiderdevs	Forumax – AI Powered Advanced Community Forum Plugin	affected 1.2.7 and earlier semver Other versions: unaffected
seezee	Five-Star Ratings Shortcode	affected 1.2.56 and earlier semver Other versions: unaffected
oxilab	Product Layouts for WooCommerce	affected 1.3.1 and earlier semver Other versions: unaffected
mr2p	Meta Field Block – Display custom fields in the Block Editor without coding	affected 1.3.3 and earlier semver Other versions: unaffected
themelocation	Custom WooCommerce Checkout Fields Editor	affected 1.3.4 and earlier semver Other versions: unaffected
100plugins	Open User Map	affected 1.4.0 and earlier semver Other versions: unaffected
wpdever	WP Notification Bell	affected 1.4.2 and earlier semver Other versions: unaffected
themelocation	Remove Add to Cart WooCommerce	affected 1.4.7 and earlier semver Other versions: unaffected
princeahmed	File Manager for Google Drive – Integrate Google Drive	affected 1.4.9 and earlier semver Other versions: unaffected
5starplugins	Marijuana Age Verify	affected 1.5.5 and earlier semver Other versions: unaffected
infosatech	RevivePress – Keep your Old Content Evergreen	affected 1.5.8 and earlier semver Other versions: unaffected
nicheaddons	Restaurant & Cafe Addon for Elementor	affected 1.5.8 and earlier semver Other versions: unaffected
paretodigital	Send Users Email – Email Subscribers, Email Marketing Newsletter	affected 1.5.10 and earlier semver Other versions: unaffected
unitecms	Unlimited Elements For Elementor	affected 1.5.140 and earlier semver Other versions: unaffected
meowcrew	Role Based Pricing for Woo by Meow Crew	affected 1.6.0 and earlier semver Other versions: unaffected
nicheaddons	Primary Addon for Elementor	affected 1.6.0 and earlier semver Other versions: unaffected
5starplugins	Featured Images in RSS for Mailchimp & More	affected 1.6.3 and earlier semver Other versions: unaffected
wpsaad	Image Alt Text Manager – Bulk & Dynamic Alt Tags For image SEO Optimization + AI	affected 1.6.3 and earlier semver Other versions: unaffected
kofimokome	Message Filter for Contact Form 7	affected 1.6.3.2 and earlier semver Other versions: unaffected
paretodigital	Embedder for Google Reviews	affected 1.6.6 and earlier semver Other versions: unaffected
interactivegeomaps	MapGeo – Interactive Geo Maps	affected 1.6.22 and earlier semver Other versions: unaffected
wpbits	WPBITS Addons For Elementor Page Builder	affected 1.7 and earlier semver Other versions: unaffected
toddhalfpenny	Widgets on Pages	affected 1.7 and earlier semver Other versions: unaffected
rebelcode	Spotlight Social Feeds – Block, Shortcode, and Widget	affected 1.7.0 and earlier semver Other versions: unaffected
tobias_conrad	WOW Styler for CF7 – Visual Styler for Contact Form 7 Forms	affected 1.7.0 and earlier semver Other versions: unaffected
webfactory	AI Bud – AI Content Generator, AI Chatbot, ChatGPT, Gemini, GPT-4o	affected 1.7.2 and earlier semver Other versions: unaffected
hasanazizul	Text To Speech TTS Accessibility	affected 1.7.34 and earlier semver Other versions: unaffected
5starplugins	Easy Age Verify	affected 1.8.5 and earlier semver Other versions: unaffected
senols	AI Puffer – Chat. Create. Automate. (formerly AI Power)	affected 1.8.99 and earlier semver Other versions: unaffected
damian-gora	Justified Gallery	affected 1.9.0 and earlier semver Other versions: unaffected
mapster	Mapster WP Maps	affected 1.9.0 and earlier semver Other versions: unaffected

And 91 more products. The full list is on the CVE record.

Identifiers: CVE-2024-13362
CNA: Wordfence
Weakness (CWE): CWE-79
Tags: sebet Go Fetch Jobs (for WP Job Manager)
5starplugins Dynamic Copyright Year
peterschulznl Code Manager
bplugins Advanced Scrollbar – Custom Scrollbar Styling and Behavior
yuvalo Goal Tracker – Custom Event Tracking for GA4
essekia Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent
josevega WP Page Templates
hkdigitalagency Payment Gateway for ACBA BANK
Cross-site scripting (XSS)
Published: 1 May 2026
Updated: 1 May 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

Score	Rating	CVSS	Vector	Source
6.1	Medium	3.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	CNA (Wordfence)

CISA KEV Not listed.
EPSS 0.0028, the 20th percentile, on 13 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 1 May 2026. New records show when each source confirmed them.

Sources

References from the CNA

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.