Veille CVE
CVE-2024-13362
6.1 MoyenneDescription
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Produits concernés
- sebet Go Fetch Jobs (for WP Job Manager)
- 5starplugins Dynamic Copyright Year
- peterschulznl Code Manager
- bplugins Advanced Scrollbar – Custom Scrollbar Styling and Behavior
- yuvalo Goal Tracker – Custom Event Tracking for GA4
- essekia Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent
- josevega WP Page Templates
- hkdigitalagency Payment Gateway for ACBA BANK
- princeahmed Dracula Dark Mode – Accessibility, Reading Mode & Dark Mode for WordPress
- spiderdevs Forumax – AI Powered Advanced Community Forum Plugin
- seezee Five-Star Ratings Shortcode
- oxilab Product Layouts for WooCommerce
- mr2p Meta Field Block – Display custom fields in the Block Editor without coding
- themelocation Custom WooCommerce Checkout Fields Editor
- 100plugins Open User Map
- wpdever WP Notification Bell
- themelocation Remove Add to Cart WooCommerce
- princeahmed File Manager for Google Drive – Integrate Google Drive
- 5starplugins Marijuana Age Verify
- infosatech RevivePress – Keep your Old Content Evergreen
- nicheaddons Restaurant & Cafe Addon for Elementor
- paretodigital Send Users Email – Email Subscribers, Email Marketing Newsletter
- unitecms Unlimited Elements For Elementor
- meowcrew Role Based Pricing for Woo by Meow Crew
- nicheaddons Primary Addon for Elementor
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 6.1 Moyenne | security@wordfence.com | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Faiblesses (CWE)
Références
- https://plugins.trac.wordpress.org/browser/add-search-to-menu/trunk/includes/freemius/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/featured-images-for-rss-feeds/trunk/includes/freemius/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/foobox-image-lightbox/tags/2.7.33/freemius/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/foogallery/tags/2.4.27/freemius/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/independent-analytics/trunk/freemius/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/interactive-geo-maps/tags/1.6.21/vendor/freemius/wordpress-sdk/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/internal-links/trunk/vendor/freemius/wordpress-sdk/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/master-addons/trunk/lib/freemius/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/menu-image/trunk/freemius/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/ocean-extra/trunk/includes/freemius/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/pdf-poster/trunk/freemius/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/shortcodes-ultimate/trunk/freemius/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/simply-gallery-block/trunk/freemius/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/spotlight-social-photo-feeds/trunk/ui/freemius-pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/tablepress/trunk/libraries/freemius/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/provider/freemius/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/widgets-on-pages/trunk/freemius/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/woo-permalink-manager/tags/2.3.11/assets/admin/js/pricing-page/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/wp-meta-and-date-remover/tags/2.3.4/freemius/assets/js/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/browser/wpide/tags/3.5.0/dist/pricing/freemius-pricing.js
- https://plugins.trac.wordpress.org/changeset/3229060/
- https://plugins.trac.wordpress.org/changeset/3235286/
- https://plugins.trac.wordpress.org/changeset/3249130/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d694491c-c0f5-4418-805a-db792ea4f712?source=cve