Media
Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Plugin de WordPress | AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading & Image Optimization | <= 2.9.2 | 2.10.0 |
| Plugin de WordPress | Custom WooCommerce Checkout Fields Editor | <= 1.3.4 | sin corrección |
| Plugin de WordPress | Ivory Search – WordPress Search Plugin | <= 5.5.8 | 5.5.9 |
| Plugin de WordPress | Advanced Classifieds & Directory Pro | <= 3.2.4 | 3.2.5 |
| Plugin de WordPress | Advanced Scrollbar – Give Your Site a Sleek Branded Scrolling Feel | <= 1.1.3 | 1.1.10 |
| Plugin de WordPress | AWCA – The Great Analytics Insights for Your eStore | <= 3.12.0 | 3.16.0 |
| Plugin de WordPress | AI Bud – AI Content Generator, AI Chatbot, ChatGPT, Gemini, GPT-4o | <= 1.7.2 | 1.8.5 |
| Plugin de WordPress | Image Alt Text Manager – Bulk & Dynamic Alt Tags For image SEO Optimization + AI | <= 1.6.3 | 1.6.6 |
| Plugin de WordPress | Auto-Install Free SSL – Generate & Install Free SSL Certificates | <= 4.5.0 | 4.5.1 |
| Plugin de WordPress | Automatic Internal Links for SEO by Pagup | <= 2.0.0 | 2.0.1 |
| Plugin de WordPress | Automatic YouTube Gallery – Embed Auto-Updating YouTube Video Galleries, Feeds, Playlists & Channels | <= 2.5.5 | 2.5.6 |
| Plugin de WordPress | Knowledge Base documentation & wiki plugin – BasePress Docs | <= 2.16.3.3 | 2.16.3.6 |
| Plugin de WordPress | bBlocks – Essential Gutenberg Blocks & Patterns Collection | <= 1.9.8 | 2.0.19 |
| Plugin de WordPress | Forumax – AI Powered Advanced Community Forum Plugin | <= 1.2.7 | 1.2.9 |
| Plugin de WordPress | BlockSpare – Gutenberg Blocks, AI Content Generator & Site Builder for news, magazine, blog and business sites | <= 3.2.6 | 3.2.8 |
| Plugin de WordPress | Blog Designer Pack – Blog, Post Grid, Post Slider, Post Carousel, Category Post, News | <= 3.4.9 | 3.4.11 |
| Plugin de WordPress | Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots | <= 2.6.7 | 2.7.0 |
| Plugin de WordPress | Bulk Auto Image Alt Text (Alt tag, Alt attribute) optimizer (image SEO) | <= 2.1.0 | 2.2.0 |
| Plugin de WordPress | Announcement & Notification Banner – Bulletin | <= 3.12.1 | 3.13.1 |
| Plugin de WordPress | Message Filter for Contact Form 7 | <= 1.6.3.2 | 1.6.3.3 |
| Plugin de WordPress | WOW Styler for CF7 – Visual Styler for Contact Form 7 Forms | <= 1.7.0 | 1.7.1 |
| Plugin de WordPress | Code Manager | <= 1.0.40 | 1.0.41 |
| Plugin de WordPress | Webheadcoder Multi-Step Forms for Contact Form 7 | <= 4.4.1 | 4.4.2 |
| Plugin de WordPress | WP Page Templates | <= 1.1.16 | 1.1.17 |
| Plugin de WordPress | Custom PHP Settings | <= 2.3.1 | 2.3.2 |
| Plugin de WordPress | Auto Post Cleaner | <= 3.9.6 | 3.9.7 |
| Plugin de WordPress | Meta Field Block – Display Custom Fields for ACF, Meta Box and More | <= 1.3.3 | 1.3.4 |
| Plugin de WordPress | Dracula Dark Mode – Accessibility, Reading Mode & Dark Mode for WordPress | <= 1.2.7 | 1.2.8 |
| Plugin de WordPress | Dynamic Copyright Year | <= 1.0.4 | 1.1 |
| Plugin de WordPress | Easy Age Verify | <= 1.8.5 | 1.9 |
| Plugin de WordPress | Easy Social Feed – Social Wall, Photos Gallery and Post Feed for WordPress | <= 6.6.5 | 6.6.6 |
| Plugin de WordPress | Marijuana Age Verify | <= 1.5.5 | 1.6 |
| Plugin de WordPress | EazyDocs – AI Powered Knowledge Base, Wiki, Documentation & FAQ Builder | <= 2.5.7 | 2.5.9 |
| Plugin de WordPress | EleSpare – News, Magazine and Blog Addons for Elementor | <= 3.3.2 | 3.3.4 |
| Plugin de WordPress | Embedder for Google Reviews | <= 1.6.6 | 1.7.5 |
| Plugin de WordPress | Events Addon for Elementor | <= 2.2.2 | 2.2.5 |
| Plugin de WordPress | Featured Images in RSS for Mailchimp & More | <= 1.6.3 | 1.6.4 |
| Plugin de WordPress | Five-Star Ratings Shortcode | <= 1.2.56 | 1.2.57 |
| Plugin de WordPress | Notification Bar, Announcement and Cookie Notice WordPress Plugin – FooBar | <= 2.1.34 | 2.1.35 |
| Plugin de WordPress | Lightbox & Modal Popup WordPress Plugin – FooBox | <= 2.7.33 | 2.7.34 |
| Plugin de WordPress | FooGallery Photo Gallery : Image, Video & Masonry Galleries | <= 2.4.27 | 2.4.29 |
| Plugin de WordPress | Full Screen Background | <= 2.0.2 | 2.0.3 |
| Plugin de WordPress | Anti-Spam Protection – No API Key, GDPR Friendly | <= 2.3.7 | 2.3.12 |
| Plugin de WordPress | TrueAna – True Analytics Dashboard | <= 2.6.0 | 2.10.0 |
| Plugin de WordPress | Geo Mashup | <= 1.13.15 | 1.13.16 |
| Plugin de WordPress | Glossary | <= 2.2.38 | 2.2.39 |
| Plugin de WordPress | Goal Tracker – Custom Event Tracking for GA4 | <= 1.1.5 | 1.1.6 |
| Plugin de WordPress | Go Fetch Jobs (for WP Job Manager) | <= 1.8.4.8.1 | 1.8.4.9.1 |
| Plugin de WordPress | AI Puffer – AI Chatbot, AI Writer & Automation | <= 1.8.99 | 2.3.17 |
| Plugin de WordPress | Team Members – A WordPress Team Plugin with Gallery, Grid, Carousel, Slider, Table, List, and More | <= 2.5.8 | 2.6.1 |
| Plugin de WordPress | Solid Testimonials – Testimonial Slider, Video Testimonials & Customer Reviews | <= 3.2.8 | 3.2.9 |
| Plugin de WordPress | HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player | <= 2.2.27 | 2.5.1 |
| Plugin de WordPress | Inavii Social Feed – Live Social Proof Gallery | <= 2.7.0 | 2.7.7 |
| Plugin de WordPress | Independent Analytics – WordPress Analytics Plugin | <= 2.9.7 | 2.10.0 |
| Plugin de WordPress | File Manager for Google Drive – Integrate Google Drive | <= 1.4.9 | 1.5.0 |
| Plugin de WordPress | MapGeo – Interactive Geo Maps | <= 1.6.22 | 1.6.23 |
| Plugin de WordPress | Internal Link Juicer: SEO Auto Linker for WordPress | <= 2.24.6 | 2.25.2 |
| Plugin de WordPress | Joli Table Of Contents | <= 2.6.0 | 2.6.1 |
| Plugin de WordPress | Justified Gallery | <= 1.9.0 | 1.10.0 |
| Plugin de WordPress | Logo Showcase – Responsive Logo Carousel, Logo Slider & Logo Grid | <= 3.2.7 | 3.2.9 |
| Plugin de WordPress | Kikote – Location Picker at Checkout & Google Address AutoFill Plugin for WooCommerce | <= 1.10.6 | 1.10.8 |
| Plugin de WordPress | Mapster WP Maps | <= 1.9.0 | 1.21.0 |
| Plugin de WordPress | Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits | <= 2.0.7.2 | 2.0.7.3 |
| Plugin de WordPress | Menu Image, Icons made easy | <= 3.12 | 3.13 |
| Plugin de WordPress | WP Mobile Menu – The Mobile-Friendly Responsive Menu | <= 2.8.6 | 2.8.7 |
| Plugin de WordPress | Music Player for Elementor – Audio Player & Podcast Player | <= 2.4.1 | 2.4.4 |
| Plugin de WordPress | Ocean Extra | <= 2.4.2 | 2.4.4 |
| Plugin de WordPress | Open User Map – Interactive Leaflet Maps | <= 1.4.0 | 1.4.1 |
| Plugin de WordPress | PDF Poster – Let visitors read PDF's without leaving the page | <= 2.2.0 | 2.3.1 |
| Plugin de WordPress | Post List Designer – Category Post, Recent Post, Post List | <= 3.3.7 | 3.3.8 |
| Plugin de WordPress | Post Slider and Post Carousel with Post Vertical Scrolling Widget – A Responsive Post Slider | <= 3.2.8 | 3.2.9 |
| Plugin de WordPress | Post Slider and Carousel Pro | <= 2.1.2 | 2.1.3 |
| Plugin de WordPress | Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App | <= 3.0.0 | 3.1.0 |
| Plugin de WordPress | Post to Google My Business (Google Business Profile) | <= 3.1.28 | 3.2.2 |
| Plugin de WordPress | Premmerce Product Filter for WooCommerce | <= 3.7.3 | sin corrección |
| Plugin de WordPress | Primary Addon for Elementor | <= 1.6.0 | 1.6.5 |
| Plugin de WordPress | Product Layouts for WooCommerce | <= 1.3.1 | 1.3.5 |
| Plugin de WordPress | Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player | <= 2.0.82 | 2.0.83 |
| Plugin de WordPress | Radio Station by netmix® – Manage and play your Show Schedule in WordPress! | <= 2.5.9 | 2.5.17 |
| Plugin de WordPress | Remove Add to Cart WooCommerce | <= 1.4.7 | sin corrección |
| Plugin de WordPress | Restaurant & Cafe Addon for Elementor | <= 1.5.8 | 1.6.1 |
| Plugin de WordPress | Restrict – membership, site, content and user access restrictions for WordPress | <= 2.3.0 | 2.3.1 |
| Plugin de WordPress | Role Based Pricing for Woo by Meow Crew | <= 1.6.0 | 1.6.1 |
| Plugin de WordPress | Security Ninja – WordPress Security & Firewall | <= 5.222 | 5.225 |
| Plugin de WordPress | Send Users Email – Email Subscribers, Email Marketing Newsletter | <= 1.5.10 | 1.6.2 |
| Plugin de WordPress | Share This Image | <= 2.07 | 2.08 |
| Plugin de WordPress | Shortcodes Ultimate – Content Elements | <= 7.3.3 | 7.3.4 |
| Plugin de WordPress | SimpLy Gallery | <= 3.2.4.4 | 3.2.4.5 |
| Plugin de WordPress | Smart phone field for Gravity Forms | <= 2.1.6 | 2.2.0 |
| Plugin de WordPress | Carousel, Recent Post Slider and Banner Slider | <= 2.1 | 2.2 |
| Plugin de WordPress | Spotlight Social Feeds – Block, Shortcode, and Widget | <= 1.7.0 | 1.7.1 |
| Plugin de WordPress | StreamWeasels Twitch Integration | <= 1.9.2 | 1.9.3 |
| Plugin de WordPress | TablePress – Tables in WordPress made easy | <= 3.0.2 | 3.0.3 |
| Plugin de WordPress | Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent | <= 1.1.13 | 1.1.17 |
| Plugin de WordPress | Text To Speech TTS Accessibility | <= 1.7.34 | 1.8.12 |
| Plugin de WordPress | TreePress – Easy Family Trees & Ancestor Profiles | <= 3.0.6 | 3.0.7 |
| Plugin de WordPress | WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto | <= 8.0.7 | 8.0.8 |
| Plugin de WordPress | Ultimeter – the Ultimate Progress and Goals Meter | <= 3.0.5 | 3.0.7 |
| Plugin de WordPress | Unlimited Elements for Elementor | <= 1.5.140 | 1.5.141 |
| Plugin de WordPress | URL Shortify – Simple and Easy URL Shortener | <= 1.10.4 | 1.10.5.1 |
| Plugin de WordPress | Checkout with Cash App on WooCommerce | <= 6.0.2 | sin corrección |
| Plugin de WordPress | Payment Gateway for ACBA BANK | <= 1.2.6 | sin corrección |
| Plugin de WordPress | Place Order Without Payment for WooCommerce | <= 2.6.5 | 2.6.7 |
| Plugin de WordPress | Thank You Page for WooCommerce | <= 4.2.0 | 4.2.1 |
| Plugin de WordPress | Appointment Booking Plugin & Scheduling System – Webba Booking Calendar | <= 5.0.57 | 5.1.8 |
| Plugin de WordPress | Display Eventbrite Events | <= 6.1.10 | 6.1.11 |
| Plugin de WordPress | Widgets on Pages | <= 1.7 | sin corrección |
| Plugin de WordPress | Secure Gateway for Authorize.net and WooCommerce by Pledged Plugins | <= 6.1.13 | 6.1.14 |
| Plugin de WordPress | Pay For Post with WooCommerce | <= 3.1.26 | 3.1.28 |
| Plugin de WordPress | Disable Payment Methods based on cart conditions for WooCommerce | <= 1.16.3 | 1.16.4 |
| Plugin de WordPress | Coupon Affiliates – Affiliate Plugin for WooCommerce | <= 5.17.2 | 5.19.0 |
| Plugin de WordPress | StoreCustomizer – A plugin to Customize all WooCommerce Pages | <= 2.5.9 | 2.6.0 |
| Plugin de WordPress | XT Floating Cart for WooCommerce | <= 2.8.4 | sin corrección |
| Plugin de WordPress | Premmerce Permalink Manager for WooCommerce | <= 2.3.11 | sin corrección |
| Plugin de WordPress | RevivePress – Keep your Old Content Evergreen | <= 1.5.8 | sin corrección |
| Plugin de WordPress | WPBITS Addons For Elementor Page Builder | <= 1.7 | sin corrección |
| Plugin de WordPress | Books Gallery – Book Showcase, Library & Affiliate Plugin | <= 4.6.8 | 4.7.6 |
| Plugin de WordPress | WP Coupons and Deals – WordPress Coupon Plugin | <= 3.2.2 | 3.2.3 |
| Plugin de WordPress | WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps | <= 5.5.31 | 5.5.32 |
| Plugin de WordPress | WP fail2ban – Advanced Security | <= 5.3.4 | 5.4.0 |
| Plugin de WordPress | WPIDE – File Manager & Code Editor | <= 3.5.1 | 3.5.2 |
| Plugin de WordPress | WP Encryption – One Click SSL / HTTPS & Free SSL Certificate, HTTPS Redirect, Security | <= 7.7.0 | 7.7.3 |
| Plugin de WordPress | WP Meta and Date Remover | <= 2.3.4 | 2.3.5 |
| Plugin de WordPress | WP Notification Bell | <= 1.4.2 | 1.4.3 |
| Plugin de WordPress | WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars | <= 3.8.3 | 3.8.4 |
| Plugin de WordPress | Bulk Edit Posts and Products in Spreadsheet | <= 2.25.16 | 2.25.19 |
| Plugin de WordPress | Team Members Showcase | <= 3.3.0 | 3.3.2 |
| Plugin de WordPress | AidWP – Donation & Payment Forms (Stripe Powered) | <= 3.2.6 | 3.2.9 |
| Plugin de WordPress | TopNewsWp – Display Tikcer News, RSS Feed Widget and Many More | <= 2.4.1 | 2.4.3 |
| Plugin de WordPress | XT Quick View for WooCommerce | <= 2.1.5 | sin corrección |
| Plugin de WordPress | XT Variation Swatches for WooCommerce | <= 1.9.4 | 1.9.7 |
| Plugin de WordPress | YASR – Yet Another Star Rating Plugin for WordPress | <= 3.4.12 | 3.4.15 |
Referencias
Puntuación CVSS
6.1/10
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N- Debilidad (CWE)
CWE-79- Plataforma
- WordPress
- Paquete
AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading & Image Optimization, Custom WooCommerce Checkout Fields Editor, Ivory Search – WordPress Search Plugin- Publicada
- 30.04.2026
- Actualizado
- 11.10.2026 10:23
Fuentes y licencias
Wordfence Intelligence - d694491c-c0f5-4418-805a-db792ea4f712 - Wordfence Intelligence
Copyright 1999-2026 The MITRE Corporation
Copyright 2012-2026 Defiant Inc.
This record contains material that is subject to copyright
Copyright 1999-2026 The MITRE Corporation
CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.
https://www.cve.org/Legal/TermsOfUseCopyright 2012-2026 Defiant Inc.
Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.
https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/Wordfence Intelligence
Wordfence Intelligence - Defiant, Inc. Copyright Defiant, Inc. All rights reserved except as granted below. License grant, section 3.1 of the Wordfence Intelligence Terms and Conditions (January 26, 2026): Subject to this Agreement, Company hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute the Service. Any copy you make for such purposes is authorized provided that you reproduce Company’s copyright designation, this license, and the license of any disclosed Company licensor in any such copy. Full applicable Agreement: https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/
Historial de vulnerabilidades: AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading & Image Optimization
Todas las vulnerabilidades publicadas de este paquete (Plugin de WordPress), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 5
- Primera → última
- 03.2022 04.2026
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Media 5
Divulgaciones por año
- 2022: 1
- 2023: 2
- 2024: 0
- 2025: 0
- 2026: 2
-
Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.