Medium
Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| WordPress plugin | AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading & Image Optimization | <= 2.9.2 | 2.10.0 |
| WordPress plugin | Custom WooCommerce Checkout Fields Editor | <= 1.3.4 | no fix |
| WordPress plugin | Ivory Search – WordPress Search Plugin | <= 5.5.8 | 5.5.9 |
| WordPress plugin | Advanced Classifieds & Directory Pro | <= 3.2.4 | 3.2.5 |
| WordPress plugin | Advanced Scrollbar – Give Your Site a Sleek Branded Scrolling Feel | <= 1.1.3 | 1.1.10 |
| WordPress plugin | AWCA – The Great Analytics Insights for Your eStore | <= 3.12.0 | 3.16.0 |
| WordPress plugin | AI Bud – AI Content Generator, AI Chatbot, ChatGPT, Gemini, GPT-4o | <= 1.7.2 | 1.8.5 |
| WordPress plugin | Image Alt Text Manager – Bulk & Dynamic Alt Tags For image SEO Optimization + AI | <= 1.6.3 | 1.6.6 |
| WordPress plugin | Auto-Install Free SSL – Generate & Install Free SSL Certificates | <= 4.5.0 | 4.5.1 |
| WordPress plugin | Automatic Internal Links for SEO by Pagup | <= 2.0.0 | 2.0.1 |
| WordPress plugin | Automatic YouTube Gallery – Embed Auto-Updating YouTube Video Galleries, Feeds, Playlists & Channels | <= 2.5.5 | 2.5.6 |
| WordPress plugin | Knowledge Base documentation & wiki plugin – BasePress Docs | <= 2.16.3.3 | 2.16.3.6 |
| WordPress plugin | bBlocks – Essential Gutenberg Blocks & Patterns Collection | <= 1.9.8 | 2.0.19 |
| WordPress plugin | Forumax – AI Powered Advanced Community Forum Plugin | <= 1.2.7 | 1.2.9 |
| WordPress plugin | BlockSpare – Gutenberg Blocks, AI Content Generator & Site Builder for news, magazine, blog and business sites | <= 3.2.6 | 3.2.8 |
| WordPress plugin | Blog Designer Pack – Blog, Post Grid, Post Slider, Post Carousel, Category Post, News | <= 3.4.9 | 3.4.11 |
| WordPress plugin | Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots | <= 2.6.7 | 2.7.0 |
| WordPress plugin | Bulk Auto Image Alt Text (Alt tag, Alt attribute) optimizer (image SEO) | <= 2.1.0 | 2.2.0 |
| WordPress plugin | Announcement & Notification Banner – Bulletin | <= 3.12.1 | 3.13.1 |
| WordPress plugin | Message Filter for Contact Form 7 | <= 1.6.3.2 | 1.6.3.3 |
| WordPress plugin | WOW Styler for CF7 – Visual Styler for Contact Form 7 Forms | <= 1.7.0 | 1.7.1 |
| WordPress plugin | Code Manager | <= 1.0.40 | 1.0.41 |
| WordPress plugin | Webheadcoder Multi-Step Forms for Contact Form 7 | <= 4.4.1 | 4.4.2 |
| WordPress plugin | WP Page Templates | <= 1.1.16 | 1.1.17 |
| WordPress plugin | Custom PHP Settings | <= 2.3.1 | 2.3.2 |
| WordPress plugin | Auto Post Cleaner | <= 3.9.6 | 3.9.7 |
| WordPress plugin | Meta Field Block – Display Custom Fields for ACF, Meta Box and More | <= 1.3.3 | 1.3.4 |
| WordPress plugin | Dracula Dark Mode – Accessibility, Reading Mode & Dark Mode for WordPress | <= 1.2.7 | 1.2.8 |
| WordPress plugin | Dynamic Copyright Year | <= 1.0.4 | 1.1 |
| WordPress plugin | Easy Age Verify | <= 1.8.5 | 1.9 |
| WordPress plugin | Easy Social Feed – Social Wall, Photos Gallery and Post Feed for WordPress | <= 6.6.5 | 6.6.6 |
| WordPress plugin | Marijuana Age Verify | <= 1.5.5 | 1.6 |
| WordPress plugin | EazyDocs – AI Powered Knowledge Base, Wiki, Documentation & FAQ Builder | <= 2.5.7 | 2.5.9 |
| WordPress plugin | EleSpare – News, Magazine and Blog Addons for Elementor | <= 3.3.2 | 3.3.4 |
| WordPress plugin | Embedder for Google Reviews | <= 1.6.6 | 1.7.5 |
| WordPress plugin | Events Addon for Elementor | <= 2.2.2 | 2.2.5 |
| WordPress plugin | Featured Images in RSS for Mailchimp & More | <= 1.6.3 | 1.6.4 |
| WordPress plugin | Five-Star Ratings Shortcode | <= 1.2.56 | 1.2.57 |
| WordPress plugin | Notification Bar, Announcement and Cookie Notice WordPress Plugin – FooBar | <= 2.1.34 | 2.1.35 |
| WordPress plugin | Lightbox & Modal Popup WordPress Plugin – FooBox | <= 2.7.33 | 2.7.34 |
| WordPress plugin | FooGallery Photo Gallery : Image, Video & Masonry Galleries | <= 2.4.27 | 2.4.29 |
| WordPress plugin | Full Screen Background | <= 2.0.2 | 2.0.3 |
| WordPress plugin | Anti-Spam Protection – No API Key, GDPR Friendly | <= 2.3.7 | 2.3.12 |
| WordPress plugin | TrueAna – True Analytics Dashboard | <= 2.6.0 | 2.10.0 |
| WordPress plugin | Geo Mashup | <= 1.13.15 | 1.13.16 |
| WordPress plugin | Glossary | <= 2.2.38 | 2.2.39 |
| WordPress plugin | Goal Tracker – Custom Event Tracking for GA4 | <= 1.1.5 | 1.1.6 |
| WordPress plugin | Go Fetch Jobs (for WP Job Manager) | <= 1.8.4.8.1 | 1.8.4.9.1 |
| WordPress plugin | AI Puffer – AI Chatbot, AI Writer & Automation | <= 1.8.99 | 2.3.17 |
| WordPress plugin | Team Members – A WordPress Team Plugin with Gallery, Grid, Carousel, Slider, Table, List, and More | <= 2.5.8 | 2.6.1 |
| WordPress plugin | Solid Testimonials – Testimonial Slider, Video Testimonials & Customer Reviews | <= 3.2.8 | 3.2.9 |
| WordPress plugin | HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player | <= 2.2.27 | 2.5.1 |
| WordPress plugin | Inavii Social Feed – Live Social Proof Gallery | <= 2.7.0 | 2.7.7 |
| WordPress plugin | Independent Analytics – WordPress Analytics Plugin | <= 2.9.7 | 2.10.0 |
| WordPress plugin | File Manager for Google Drive – Integrate Google Drive | <= 1.4.9 | 1.5.0 |
| WordPress plugin | MapGeo – Interactive Geo Maps | <= 1.6.22 | 1.6.23 |
| WordPress plugin | Internal Link Juicer: SEO Auto Linker for WordPress | <= 2.24.6 | 2.25.2 |
| WordPress plugin | Joli Table Of Contents | <= 2.6.0 | 2.6.1 |
| WordPress plugin | Justified Gallery | <= 1.9.0 | 1.10.0 |
| WordPress plugin | Logo Showcase – Responsive Logo Carousel, Logo Slider & Logo Grid | <= 3.2.7 | 3.2.9 |
| WordPress plugin | Kikote – Location Picker at Checkout & Google Address AutoFill Plugin for WooCommerce | <= 1.10.6 | 1.10.8 |
| WordPress plugin | Mapster WP Maps | <= 1.9.0 | 1.21.0 |
| WordPress plugin | Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits | <= 2.0.7.2 | 2.0.7.3 |
| WordPress plugin | Menu Image, Icons made easy | <= 3.12 | 3.13 |
| WordPress plugin | WP Mobile Menu – The Mobile-Friendly Responsive Menu | <= 2.8.6 | 2.8.7 |
| WordPress plugin | Music Player for Elementor – Audio Player & Podcast Player | <= 2.4.1 | 2.4.4 |
| WordPress plugin | Ocean Extra | <= 2.4.2 | 2.4.4 |
| WordPress plugin | Open User Map – Interactive Leaflet Maps | <= 1.4.0 | 1.4.1 |
| WordPress plugin | PDF Poster – Let visitors read PDF's without leaving the page | <= 2.2.0 | 2.3.1 |
| WordPress plugin | Post List Designer – Category Post, Recent Post, Post List | <= 3.3.7 | 3.3.8 |
| WordPress plugin | Post Slider and Post Carousel with Post Vertical Scrolling Widget – A Responsive Post Slider | <= 3.2.8 | 3.2.9 |
| WordPress plugin | Post Slider and Carousel Pro | <= 2.1.2 | 2.1.3 |
| WordPress plugin | Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App | <= 3.0.0 | 3.1.0 |
| WordPress plugin | Post to Google My Business (Google Business Profile) | <= 3.1.28 | 3.2.2 |
| WordPress plugin | Premmerce Product Filter for WooCommerce | <= 3.7.3 | no fix |
| WordPress plugin | Primary Addon for Elementor | <= 1.6.0 | 1.6.5 |
| WordPress plugin | Product Layouts for WooCommerce | <= 1.3.1 | 1.3.5 |
| WordPress plugin | Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player | <= 2.0.82 | 2.0.83 |
| WordPress plugin | Radio Station by netmix® – Manage and play your Show Schedule in WordPress! | <= 2.5.9 | 2.5.17 |
| WordPress plugin | Remove Add to Cart WooCommerce | <= 1.4.7 | no fix |
| WordPress plugin | Restaurant & Cafe Addon for Elementor | <= 1.5.8 | 1.6.1 |
| WordPress plugin | Restrict – membership, site, content and user access restrictions for WordPress | <= 2.3.0 | 2.3.1 |
| WordPress plugin | Role Based Pricing for Woo by Meow Crew | <= 1.6.0 | 1.6.1 |
| WordPress plugin | Security Ninja – WordPress Security & Firewall | <= 5.222 | 5.225 |
| WordPress plugin | Send Users Email – Email Subscribers, Email Marketing Newsletter | <= 1.5.10 | 1.6.2 |
| WordPress plugin | Share This Image | <= 2.07 | 2.08 |
| WordPress plugin | Shortcodes Ultimate – Content Elements | <= 7.3.3 | 7.3.4 |
| WordPress plugin | SimpLy Gallery | <= 3.2.4.4 | 3.2.4.5 |
| WordPress plugin | Smart phone field for Gravity Forms | <= 2.1.6 | 2.2.0 |
| WordPress plugin | Carousel, Recent Post Slider and Banner Slider | <= 2.1 | 2.2 |
| WordPress plugin | Spotlight Social Feeds – Block, Shortcode, and Widget | <= 1.7.0 | 1.7.1 |
| WordPress plugin | StreamWeasels Twitch Integration | <= 1.9.2 | 1.9.3 |
| WordPress plugin | TablePress – Tables in WordPress made easy | <= 3.0.2 | 3.0.3 |
| WordPress plugin | Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent | <= 1.1.13 | 1.1.17 |
| WordPress plugin | Text To Speech TTS Accessibility | <= 1.7.34 | 1.8.12 |
| WordPress plugin | TreePress – Easy Family Trees & Ancestor Profiles | <= 3.0.6 | 3.0.7 |
| WordPress plugin | WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto | <= 8.0.7 | 8.0.8 |
| WordPress plugin | Ultimeter – the Ultimate Progress and Goals Meter | <= 3.0.5 | 3.0.7 |
| WordPress plugin | Unlimited Elements for Elementor | <= 1.5.140 | 1.5.141 |
| WordPress plugin | URL Shortify – Simple and Easy URL Shortener | <= 1.10.4 | 1.10.5.1 |
| WordPress plugin | Checkout with Cash App on WooCommerce | <= 6.0.2 | no fix |
| WordPress plugin | Payment Gateway for ACBA BANK | <= 1.2.6 | no fix |
| WordPress plugin | Place Order Without Payment for WooCommerce | <= 2.6.5 | 2.6.7 |
| WordPress plugin | Thank You Page for WooCommerce | <= 4.2.0 | 4.2.1 |
| WordPress plugin | Appointment Booking Plugin & Scheduling System – Webba Booking Calendar | <= 5.0.57 | 5.1.8 |
| WordPress plugin | Display Eventbrite Events | <= 6.1.10 | 6.1.11 |
| WordPress plugin | Widgets on Pages | <= 1.7 | no fix |
| WordPress plugin | Secure Gateway for Authorize.net and WooCommerce by Pledged Plugins | <= 6.1.13 | 6.1.14 |
| WordPress plugin | Pay For Post with WooCommerce | <= 3.1.26 | 3.1.28 |
| WordPress plugin | Disable Payment Methods based on cart conditions for WooCommerce | <= 1.16.3 | 1.16.4 |
| WordPress plugin | Coupon Affiliates – Affiliate Plugin for WooCommerce | <= 5.17.2 | 5.19.0 |
| WordPress plugin | StoreCustomizer – A plugin to Customize all WooCommerce Pages | <= 2.5.9 | 2.6.0 |
| WordPress plugin | XT Floating Cart for WooCommerce | <= 2.8.4 | no fix |
| WordPress plugin | Premmerce Permalink Manager for WooCommerce | <= 2.3.11 | no fix |
| WordPress plugin | RevivePress – Keep your Old Content Evergreen | <= 1.5.8 | no fix |
| WordPress plugin | WPBITS Addons For Elementor Page Builder | <= 1.7 | no fix |
| WordPress plugin | Books Gallery – Book Showcase, Library & Affiliate Plugin | <= 4.6.8 | 4.7.6 |
| WordPress plugin | WP Coupons and Deals – WordPress Coupon Plugin | <= 3.2.2 | 3.2.3 |
| WordPress plugin | WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps | <= 5.5.31 | 5.5.32 |
| WordPress plugin | WP fail2ban – Advanced Security | <= 5.3.4 | 5.4.0 |
| WordPress plugin | WPIDE – File Manager & Code Editor | <= 3.5.1 | 3.5.2 |
| WordPress plugin | WP Encryption – One Click SSL / HTTPS & Free SSL Certificate, HTTPS Redirect, Security | <= 7.7.0 | 7.7.3 |
| WordPress plugin | WP Meta and Date Remover | <= 2.3.4 | 2.3.5 |
| WordPress plugin | WP Notification Bell | <= 1.4.2 | 1.4.3 |
| WordPress plugin | WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars | <= 3.8.3 | 3.8.4 |
| WordPress plugin | Bulk Edit Posts and Products in Spreadsheet | <= 2.25.16 | 2.25.19 |
| WordPress plugin | Team Members Showcase | <= 3.3.0 | 3.3.2 |
| WordPress plugin | AidWP – Donation & Payment Forms (Stripe Powered) | <= 3.2.6 | 3.2.9 |
| WordPress plugin | TopNewsWp – Display Tikcer News, RSS Feed Widget and Many More | <= 2.4.1 | 2.4.3 |
| WordPress plugin | XT Quick View for WooCommerce | <= 2.1.5 | no fix |
| WordPress plugin | XT Variation Swatches for WooCommerce | <= 1.9.4 | 1.9.7 |
| WordPress plugin | YASR – Yet Another Star Rating Plugin for WordPress | <= 3.4.12 | 3.4.15 |
References
CVSS score
6.1/10
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N- Weakness (CWE)
CWE-79- Platform
- WordPress
- Package
AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading & Image Optimization, Custom WooCommerce Checkout Fields Editor, Ivory Search – WordPress Search Plugin- Disclosed
- 30.04.2026
- Updated
- 11.10.2026 10:23
Sources and licenses
Wordfence Intelligence - d694491c-c0f5-4418-805a-db792ea4f712 - Wordfence Intelligence
Copyright 1999-2026 The MITRE Corporation
Copyright 2012-2026 Defiant Inc.
This record contains material that is subject to copyright
Copyright 1999-2026 The MITRE Corporation
CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.
https://www.cve.org/Legal/TermsOfUseCopyright 2012-2026 Defiant Inc.
Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.
https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/Wordfence Intelligence
Wordfence Intelligence - Defiant, Inc. Copyright Defiant, Inc. All rights reserved except as granted below. License grant, section 3.1 of the Wordfence Intelligence Terms and Conditions (January 26, 2026): Subject to this Agreement, Company hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute the Service. Any copy you make for such purposes is authorized provided that you reproduce Company’s copyright designation, this license, and the license of any disclosed Company licensor in any such copy. Full applicable Agreement: https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/
Vulnerability history: AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading & Image Optimization
All published vulnerabilities of this package (WordPress plugin), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 5
- First → latest
- 03.2022 04.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Medium 5
Disclosures per year
- 2022: 1
- 2023: 2
- 2024: 0
- 2025: 0
- 2026: 2
-
Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.