6.1
Medium
CVE-2024-13362 Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in…
Description
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Go Fetch Jobs (for WP Job Manager) 1.8 | earliest → 1.8.4.8.1 | No fix stated |
| Dynamic Copyright Year 1.0 | earliest → 1.0.4 | No fix stated |
| Code Manager 1.0 | earliest → 1.0.40 | No fix stated |
| Advanced Scrollbar – Custom Scrollbar Styling and Behavior 1.1 | earliest → 1.1.3 | No fix stated |
| Goal Tracker – Custom Event Tracking for GA4 1.1 | earliest → 1.1.5 | No fix stated |
| Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent 1.1 | earliest → 1.1.13 | No fix stated |
| WP Page Templates 1.1 | earliest → 1.1.16 | No fix stated |
| Payment Gateway for ACBA BANK 1.2 | earliest → 1.2.6 | No fix stated |
| Dracula Dark Mode – Accessibility, Reading Mode & Dark Mode for WordPress 1.2 | earliest → 1.2.7 | No fix stated |