Mittel

Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter

Veröffentlicht: 30.04.2026
Aktualisiert: 11.10.2026 10:23

Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Betroffene Software

Klicken Sie auf eine Technologie, um alle zugehörigen Schwachstellen anzuzeigen.

Plattform	Paket	Anfällige Versionen	Behoben in
WordPress-Plugin	AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading & Image Optimization	<= 2.9.2	2.10.0
WordPress-Plugin	Custom WooCommerce Checkout Fields Editor	<= 1.3.4	keine Korrektur
WordPress-Plugin	Ivory Search – WordPress Search Plugin	<= 5.5.8	5.5.9
WordPress-Plugin	Advanced Classifieds & Directory Pro	<= 3.2.4	3.2.5
WordPress-Plugin	Advanced Scrollbar – Give Your Site a Sleek Branded Scrolling Feel	<= 1.1.3	1.1.10
WordPress-Plugin	AWCA – The Great Analytics Insights for Your eStore	<= 3.12.0	3.16.0
WordPress-Plugin	AI Bud – AI Content Generator, AI Chatbot, ChatGPT, Gemini, GPT-4o	<= 1.7.2	1.8.5
WordPress-Plugin	Image Alt Text Manager – Bulk & Dynamic Alt Tags For image SEO Optimization + AI	<= 1.6.3	1.6.6
WordPress-Plugin	Auto-Install Free SSL – Generate & Install Free SSL Certificates	<= 4.5.0	4.5.1
WordPress-Plugin	Automatic Internal Links for SEO by Pagup	<= 2.0.0	2.0.1
WordPress-Plugin	Automatic YouTube Gallery – Embed Auto-Updating YouTube Video Galleries, Feeds, Playlists & Channels	<= 2.5.5	2.5.6
WordPress-Plugin	Knowledge Base documentation & wiki plugin – BasePress Docs	<= 2.16.3.3	2.16.3.6
WordPress-Plugin	bBlocks – Essential Gutenberg Blocks & Patterns Collection	<= 1.9.8	2.0.19
WordPress-Plugin	Forumax – AI Powered Advanced Community Forum Plugin	<= 1.2.7	1.2.9
WordPress-Plugin	BlockSpare – Gutenberg Blocks, AI Content Generator & Site Builder for news, magazine, blog and business sites	<= 3.2.6	3.2.8
WordPress-Plugin	Blog Designer Pack – Blog, Post Grid, Post Slider, Post Carousel, Category Post, News	<= 3.4.9	3.4.11
WordPress-Plugin	Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots	<= 2.6.7	2.7.0
WordPress-Plugin	Bulk Auto Image Alt Text (Alt tag, Alt attribute) optimizer (image SEO)	<= 2.1.0	2.2.0
WordPress-Plugin	Announcement & Notification Banner – Bulletin	<= 3.12.1	3.13.1
WordPress-Plugin	Message Filter for Contact Form 7	<= 1.6.3.2	1.6.3.3
WordPress-Plugin	WOW Styler for CF7 – Visual Styler for Contact Form 7 Forms	<= 1.7.0	1.7.1
WordPress-Plugin	Code Manager	<= 1.0.40	1.0.41
WordPress-Plugin	Webheadcoder Multi-Step Forms for Contact Form 7	<= 4.4.1	4.4.2
WordPress-Plugin	WP Page Templates	<= 1.1.16	1.1.17
WordPress-Plugin	Custom PHP Settings	<= 2.3.1	2.3.2
WordPress-Plugin	Auto Post Cleaner	<= 3.9.6	3.9.7
WordPress-Plugin	Meta Field Block – Display Custom Fields for ACF, Meta Box and More	<= 1.3.3	1.3.4
WordPress-Plugin	Dracula Dark Mode – Accessibility, Reading Mode & Dark Mode for WordPress	<= 1.2.7	1.2.8
WordPress-Plugin	Dynamic Copyright Year	<= 1.0.4	1.1
WordPress-Plugin	Easy Age Verify	<= 1.8.5	1.9
WordPress-Plugin	Easy Social Feed – Social Wall, Photos Gallery and Post Feed for WordPress	<= 6.6.5	6.6.6
WordPress-Plugin	Marijuana Age Verify	<= 1.5.5	1.6
WordPress-Plugin	EazyDocs – AI Powered Knowledge Base, Wiki, Documentation & FAQ Builder	<= 2.5.7	2.5.9
WordPress-Plugin	EleSpare – News, Magazine and Blog Addons for Elementor	<= 3.3.2	3.3.4
WordPress-Plugin	Embedder for Google Reviews	<= 1.6.6	1.7.5
WordPress-Plugin	Events Addon for Elementor	<= 2.2.2	2.2.5
WordPress-Plugin	Featured Images in RSS for Mailchimp & More	<= 1.6.3	1.6.4
WordPress-Plugin	Five-Star Ratings Shortcode	<= 1.2.56	1.2.57
WordPress-Plugin	Notification Bar, Announcement and Cookie Notice WordPress Plugin – FooBar	<= 2.1.34	2.1.35
WordPress-Plugin	Lightbox & Modal Popup WordPress Plugin – FooBox	<= 2.7.33	2.7.34
WordPress-Plugin	FooGallery Photo Gallery : Image, Video & Masonry Galleries	<= 2.4.27	2.4.29
WordPress-Plugin	Full Screen Background	<= 2.0.2	2.0.3
WordPress-Plugin	Anti-Spam Protection – No API Key, GDPR Friendly	<= 2.3.7	2.3.12
WordPress-Plugin	TrueAna – True Analytics Dashboard	<= 2.6.0	2.10.0
WordPress-Plugin	Geo Mashup	<= 1.13.15	1.13.16
WordPress-Plugin	Glossary	<= 2.2.38	2.2.39
WordPress-Plugin	Goal Tracker – Custom Event Tracking for GA4	<= 1.1.5	1.1.6
WordPress-Plugin	Go Fetch Jobs (for WP Job Manager)	<= 1.8.4.8.1	1.8.4.9.1
WordPress-Plugin	AI Puffer – AI Chatbot, AI Writer & Automation	<= 1.8.99	2.3.17
WordPress-Plugin	Team Members – A WordPress Team Plugin with Gallery, Grid, Carousel, Slider, Table, List, and More	<= 2.5.8	2.6.1
WordPress-Plugin	Solid Testimonials – Testimonial Slider, Video Testimonials & Customer Reviews	<= 3.2.8	3.2.9
WordPress-Plugin	HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player	<= 2.2.27	2.5.1
WordPress-Plugin	Inavii Social Feed – Live Social Proof Gallery	<= 2.7.0	2.7.7
WordPress-Plugin	Independent Analytics – WordPress Analytics Plugin	<= 2.9.7	2.10.0
WordPress-Plugin	File Manager for Google Drive – Integrate Google Drive	<= 1.4.9	1.5.0
WordPress-Plugin	MapGeo – Interactive Geo Maps	<= 1.6.22	1.6.23
WordPress-Plugin	Internal Link Juicer: SEO Auto Linker for WordPress	<= 2.24.6	2.25.2
WordPress-Plugin	Joli Table Of Contents	<= 2.6.0	2.6.1
WordPress-Plugin	Justified Gallery	<= 1.9.0	1.10.0
WordPress-Plugin	Logo Showcase – Responsive Logo Carousel, Logo Slider & Logo Grid	<= 3.2.7	3.2.9
WordPress-Plugin	Kikote – Location Picker at Checkout & Google Address AutoFill Plugin for WooCommerce	<= 1.10.6	1.10.8
WordPress-Plugin	Mapster WP Maps	<= 1.9.0	1.21.0
WordPress-Plugin	Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits	<= 2.0.7.2	2.0.7.3
WordPress-Plugin	Menu Image, Icons made easy	<= 3.12	3.13
WordPress-Plugin	WP Mobile Menu – The Mobile-Friendly Responsive Menu	<= 2.8.6	2.8.7
WordPress-Plugin	Music Player for Elementor – Audio Player & Podcast Player	<= 2.4.1	2.4.4
WordPress-Plugin	Ocean Extra	<= 2.4.2	2.4.4
WordPress-Plugin	Open User Map – Interactive Leaflet Maps	<= 1.4.0	1.4.1
WordPress-Plugin	PDF Poster – Let visitors read PDF's without leaving the page	<= 2.2.0	2.3.1
WordPress-Plugin	Post List Designer – Category Post, Recent Post, Post List	<= 3.3.7	3.3.8
WordPress-Plugin	Post Slider and Post Carousel with Post Vertical Scrolling Widget – A Responsive Post Slider	<= 3.2.8	3.2.9
WordPress-Plugin	Post Slider and Carousel Pro	<= 2.1.2	2.1.3
WordPress-Plugin	Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App	<= 3.0.0	3.1.0
WordPress-Plugin	Post to Google My Business (Google Business Profile)	<= 3.1.28	3.2.2
WordPress-Plugin	Premmerce Product Filter for WooCommerce	<= 3.7.3	keine Korrektur
WordPress-Plugin	Primary Addon for Elementor	<= 1.6.0	1.6.5
WordPress-Plugin	Product Layouts for WooCommerce	<= 1.3.1	1.3.5
WordPress-Plugin	Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player	<= 2.0.82	2.0.83
WordPress-Plugin	Radio Station by netmix® – Manage and play your Show Schedule in WordPress!	<= 2.5.9	2.5.17
WordPress-Plugin	Remove Add to Cart WooCommerce	<= 1.4.7	keine Korrektur
WordPress-Plugin	Restaurant & Cafe Addon for Elementor	<= 1.5.8	1.6.1
WordPress-Plugin	Restrict – membership, site, content and user access restrictions for WordPress	<= 2.3.0	2.3.1
WordPress-Plugin	Role Based Pricing for Woo by Meow Crew	<= 1.6.0	1.6.1
WordPress-Plugin	Security Ninja – WordPress Security & Firewall	<= 5.222	5.225
WordPress-Plugin	Send Users Email – Email Subscribers, Email Marketing Newsletter	<= 1.5.10	1.6.2
WordPress-Plugin	Share This Image	<= 2.07	2.08
WordPress-Plugin	Shortcodes Ultimate – Content Elements	<= 7.3.3	7.3.4
WordPress-Plugin	SimpLy Gallery	<= 3.2.4.4	3.2.4.5
WordPress-Plugin	Smart phone field for Gravity Forms	<= 2.1.6	2.2.0
WordPress-Plugin	Carousel, Recent Post Slider and Banner Slider	<= 2.1	2.2
WordPress-Plugin	Spotlight Social Feeds – Block, Shortcode, and Widget	<= 1.7.0	1.7.1
WordPress-Plugin	StreamWeasels Twitch Integration	<= 1.9.2	1.9.3
WordPress-Plugin	TablePress – Tables in WordPress made easy	<= 3.0.2	3.0.3
WordPress-Plugin	Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent	<= 1.1.13	1.1.17
WordPress-Plugin	Text To Speech TTS Accessibility	<= 1.7.34	1.8.12
WordPress-Plugin	TreePress – Easy Family Trees & Ancestor Profiles	<= 3.0.6	3.0.7
WordPress-Plugin	WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto	<= 8.0.7	8.0.8
WordPress-Plugin	Ultimeter – the Ultimate Progress and Goals Meter	<= 3.0.5	3.0.7
WordPress-Plugin	Unlimited Elements for Elementor	<= 1.5.140	1.5.141
WordPress-Plugin	URL Shortify – Simple and Easy URL Shortener	<= 1.10.4	1.10.5.1
WordPress-Plugin	Checkout with Cash App on WooCommerce	<= 6.0.2	keine Korrektur
WordPress-Plugin	Payment Gateway for ACBA BANK	<= 1.2.6	keine Korrektur
WordPress-Plugin	Place Order Without Payment for WooCommerce	<= 2.6.5	2.6.7
WordPress-Plugin	Thank You Page for WooCommerce	<= 4.2.0	4.2.1
WordPress-Plugin	Appointment Booking Plugin & Scheduling System – Webba Booking Calendar	<= 5.0.57	5.1.8
WordPress-Plugin	Display Eventbrite Events	<= 6.1.10	6.1.11
WordPress-Plugin	Widgets on Pages	<= 1.7	keine Korrektur
WordPress-Plugin	Secure Gateway for Authorize.net and WooCommerce by Pledged Plugins	<= 6.1.13	6.1.14
WordPress-Plugin	Pay For Post with WooCommerce	<= 3.1.26	3.1.28
WordPress-Plugin	Disable Payment Methods based on cart conditions for WooCommerce	<= 1.16.3	1.16.4
WordPress-Plugin	Coupon Affiliates – Affiliate Plugin for WooCommerce	<= 5.17.2	5.19.0
WordPress-Plugin	StoreCustomizer – A plugin to Customize all WooCommerce Pages	<= 2.5.9	2.6.0
WordPress-Plugin	XT Floating Cart for WooCommerce	<= 2.8.4	keine Korrektur
WordPress-Plugin	Premmerce Permalink Manager for WooCommerce	<= 2.3.11	keine Korrektur
WordPress-Plugin	RevivePress – Keep your Old Content Evergreen	<= 1.5.8	keine Korrektur
WordPress-Plugin	WPBITS Addons For Elementor Page Builder	<= 1.7	keine Korrektur
WordPress-Plugin	Books Gallery – Book Showcase, Library & Affiliate Plugin	<= 4.6.8	4.7.6
WordPress-Plugin	WP Coupons and Deals – WordPress Coupon Plugin	<= 3.2.2	3.2.3
WordPress-Plugin	WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps	<= 5.5.31	5.5.32
WordPress-Plugin	WP fail2ban – Advanced Security	<= 5.3.4	5.4.0
WordPress-Plugin	WPIDE – File Manager & Code Editor	<= 3.5.1	3.5.2
WordPress-Plugin	WP Encryption – One Click SSL / HTTPS & Free SSL Certificate, HTTPS Redirect, Security	<= 7.7.0	7.7.3
WordPress-Plugin	WP Meta and Date Remover	<= 2.3.4	2.3.5
WordPress-Plugin	WP Notification Bell	<= 1.4.2	1.4.3
WordPress-Plugin	WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars	<= 3.8.3	3.8.4
WordPress-Plugin	Bulk Edit Posts and Products in Spreadsheet	<= 2.25.16	2.25.19
WordPress-Plugin	Team Members Showcase	<= 3.3.0	3.3.2
WordPress-Plugin	AidWP – Donation & Payment Forms (Stripe Powered)	<= 3.2.6	3.2.9
WordPress-Plugin	TopNewsWp – Display Tikcer News, RSS Feed Widget and Many More	<= 2.4.1	2.4.3
WordPress-Plugin	XT Quick View for WooCommerce	<= 2.1.5	keine Korrektur
WordPress-Plugin	XT Variation Swatches for WooCommerce	<= 1.9.4	1.9.7
WordPress-Plugin	YASR – Yet Another Star Rating Plugin for WordPress	<= 3.4.12	3.4.15

Verweise

https://www.wordfence.com/threat-intel/vulnerabilities/id/d694491c-c0f5-4418-805a-db792ea4f712?source=api-prod

CVSS-Wert 6.1/10

CVSS-Vektor: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Schwäche (CWE): CWE-79
Plattform: WordPress
Paket: AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading & Image Optimization, Custom WooCommerce Checkout Fields Editor, Ivory Search – WordPress Search Plugin
Veröffentlicht: 30.04.2026
Aktualisiert: 11.10.2026 10:23

Quellen und Lizenzen

Wordfence Intelligence - d694491c-c0f5-4418-805a-db792ea4f712 - Wordfence Intelligence

This record contains material that is subject to copyright

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

https://www.cve.org/Legal/TermsOfUse

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/

Wordfence Intelligence

Wordfence Intelligence - Defiant, Inc.
Copyright Defiant, Inc. All rights reserved except as granted below.
License grant, section 3.1 of the Wordfence Intelligence Terms and Conditions (January 26, 2026):

Subject to this Agreement, Company hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute the Service. Any copy you make for such purposes is authorized provided that you reproduce Company’s copyright designation, this license, and the license of any disclosed Company licensor in any such copy.

Full applicable Agreement: https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/

Schwachstellenhistorie: Ivory Search – WordPress Search Plugin

Alle veröffentlichten Schwachstellen dieses Pakets (WordPress-Plugin), neueste zuerst. Zeigt, ob es ein einmaliger Ausrutscher ist oder ein Paket, das man im Auge behalten muss.

Alle (16) im Archiv

Einträge insgesamt: 16
Erste → letzte: 02.2021 10.2026
Ohne Fix: 0
In Angriffen ausgenutzt: 0

Verteilung nach Schweregrad

Mittel 16

Veröffentlichungen pro Jahr

2021: 4
2022: 3
2023: 1
2024: 2
2025: 2
2026: 4

02.10.2026

Ivory Search <= 5.5.18 - Reflected DOM-Based Cross-Site Scripting via 's' Parameter

Mittel · 6.1 CVE-2026-92243 <= 5.5.18 5.5.19
26.06.2026

Ivory Search <= 5.5.15 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu_title' and 'menu_magnifier_color' Settings

Mittel · 4.4 CVE-2026-11356 <= 5.5.15 5.5.16
30.04.2026

Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter dieser Eintrag

Mittel · 6.1 CVE-2024-13362 <= 5.5.8 5.5.9
27.01.2026

Ivory Search <= 5.5.13 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu_gcse' and 'nothing_found_text' Parameters

Mittel · 4.4 CVE-2026-1053 <= 5.5.13 5.5.14
28.09.2025

Ivory Search <= 5.5.12 - Missing Authorization

Mittel · 5.3 CVE-2025-63069 <= 5.5.12 5.5.13
27.05.2025

Ivory Search – WordPress Search Plugin <= 5.5.9 - Authenticated (Admin+) Stored Cross-Site Scripting

Mittel · 4.4 CVE-2025-5209 <= 5.5.9 5.5.10
04.09.2024

Ivory Search – WordPress Search Plugin <= 5.5.6 - Information Exposure via AJAX Search Form

Mittel · 5.3 CVE-2024-6835 <= 5.5.6 5.5.7
12.04.2024

Ivory Search – WordPress Search Plugin <= 5.5.5 - Missing Authorization to Authenticated (Subscriber+) Index Creation

Mittel · 4.3 CVE-2024-3233 <= 5.5.5 5.5.6
18.07.2023

Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get

Mittel · 6.1 CVE-2023-33999 >= 4.0, <= 5.5.1 5.5.2
04.07.2022

Ivory Search <= 5.4.6 - Reflected Cross-Site Scripting

Mittel · 6.1 a1513296-f7f6-468c-ac96-5f55812d943e <= 5.4.6 5.4.7
04.03.2022

Freemius SDK <= 2.4.2 - Missing Authorization Checks

Mittel · 6.3 CVE-2022-4974 < 5.4.4 5.4.4
10.01.2022

Ivory Search <= 5.4 - Multiple Admin+ Stored Cross-Site Scripting

Mittel · 4.8 CVE-2021-25105 <= 5.4 5.4.1
02.11.2021

Ivory Search <= 4.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Mittel · 6.4 35b9f37c-69e1-437a-97dd-3d3e7a8cd86e <= 4.7.1 4.8
01.10.2021

Ivory Search <= 4.6.6 - Reflected Cross-Site Scripting

Mittel · 6.1 CVE-2021-36869 <= 4.6.6 4.7
30.03.2021

Ivory Search <= 4.6 - Reflected Cross Site Scripting

Mittel · 6.1 CVE-2021-24234 <= 4.6 4.6.1
01.02.2021

Ivory Search – WordPress Search Plugin <= 4.5.10 - Reflected Cross-Site Scripting

Mittel · 6.1 6da0a85d-0c6f-40ae-8a3d-85222f0e7cc5 <= 4.5.10 4.5.11

Erkennen Sie Schwachstellen in Ihrer Anwendung

Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.

Anwendung verbinden