Mittel
Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Betroffene Software
Klicken Sie auf eine Technologie, um alle zugehörigen Schwachstellen anzuzeigen.
| Plattform | Paket | Anfällige Versionen | Behoben in |
|---|---|---|---|
| WordPress-Plugin | AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading & Image Optimization | <= 2.9.2 | 2.10.0 |
| WordPress-Plugin | Custom WooCommerce Checkout Fields Editor | <= 1.3.4 | keine Korrektur |
| WordPress-Plugin | Ivory Search – WordPress Search Plugin | <= 5.5.8 | 5.5.9 |
| WordPress-Plugin | Advanced Classifieds & Directory Pro | <= 3.2.4 | 3.2.5 |
| WordPress-Plugin | Advanced Scrollbar – Give Your Site a Sleek Branded Scrolling Feel | <= 1.1.3 | 1.1.10 |
| WordPress-Plugin | AWCA – The Great Analytics Insights for Your eStore | <= 3.12.0 | 3.16.0 |
| WordPress-Plugin | AI Bud – AI Content Generator, AI Chatbot, ChatGPT, Gemini, GPT-4o | <= 1.7.2 | 1.8.5 |
| WordPress-Plugin | Image Alt Text Manager – Bulk & Dynamic Alt Tags For image SEO Optimization + AI | <= 1.6.3 | 1.6.6 |
| WordPress-Plugin | Auto-Install Free SSL – Generate & Install Free SSL Certificates | <= 4.5.0 | 4.5.1 |
| WordPress-Plugin | Automatic Internal Links for SEO by Pagup | <= 2.0.0 | 2.0.1 |
| WordPress-Plugin | Automatic YouTube Gallery – Embed Auto-Updating YouTube Video Galleries, Feeds, Playlists & Channels | <= 2.5.5 | 2.5.6 |
| WordPress-Plugin | Knowledge Base documentation & wiki plugin – BasePress Docs | <= 2.16.3.3 | 2.16.3.6 |
| WordPress-Plugin | bBlocks – Essential Gutenberg Blocks & Patterns Collection | <= 1.9.8 | 2.0.19 |
| WordPress-Plugin | Forumax – AI Powered Advanced Community Forum Plugin | <= 1.2.7 | 1.2.9 |
| WordPress-Plugin | BlockSpare – Gutenberg Blocks, AI Content Generator & Site Builder for news, magazine, blog and business sites | <= 3.2.6 | 3.2.8 |
| WordPress-Plugin | Blog Designer Pack – Blog, Post Grid, Post Slider, Post Carousel, Category Post, News | <= 3.4.9 | 3.4.11 |
| WordPress-Plugin | Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots | <= 2.6.7 | 2.7.0 |
| WordPress-Plugin | Bulk Auto Image Alt Text (Alt tag, Alt attribute) optimizer (image SEO) | <= 2.1.0 | 2.2.0 |
| WordPress-Plugin | Announcement & Notification Banner – Bulletin | <= 3.12.1 | 3.13.1 |
| WordPress-Plugin | Message Filter for Contact Form 7 | <= 1.6.3.2 | 1.6.3.3 |
| WordPress-Plugin | WOW Styler for CF7 – Visual Styler for Contact Form 7 Forms | <= 1.7.0 | 1.7.1 |
| WordPress-Plugin | Code Manager | <= 1.0.40 | 1.0.41 |
| WordPress-Plugin | Webheadcoder Multi-Step Forms for Contact Form 7 | <= 4.4.1 | 4.4.2 |
| WordPress-Plugin | WP Page Templates | <= 1.1.16 | 1.1.17 |
| WordPress-Plugin | Custom PHP Settings | <= 2.3.1 | 2.3.2 |
| WordPress-Plugin | Auto Post Cleaner | <= 3.9.6 | 3.9.7 |
| WordPress-Plugin | Meta Field Block – Display Custom Fields for ACF, Meta Box and More | <= 1.3.3 | 1.3.4 |
| WordPress-Plugin | Dracula Dark Mode – Accessibility, Reading Mode & Dark Mode for WordPress | <= 1.2.7 | 1.2.8 |
| WordPress-Plugin | Dynamic Copyright Year | <= 1.0.4 | 1.1 |
| WordPress-Plugin | Easy Age Verify | <= 1.8.5 | 1.9 |
| WordPress-Plugin | Easy Social Feed – Social Wall, Photos Gallery and Post Feed for WordPress | <= 6.6.5 | 6.6.6 |
| WordPress-Plugin | Marijuana Age Verify | <= 1.5.5 | 1.6 |
| WordPress-Plugin | EazyDocs – AI Powered Knowledge Base, Wiki, Documentation & FAQ Builder | <= 2.5.7 | 2.5.9 |
| WordPress-Plugin | EleSpare – News, Magazine and Blog Addons for Elementor | <= 3.3.2 | 3.3.4 |
| WordPress-Plugin | Embedder for Google Reviews | <= 1.6.6 | 1.7.5 |
| WordPress-Plugin | Events Addon for Elementor | <= 2.2.2 | 2.2.5 |
| WordPress-Plugin | Featured Images in RSS for Mailchimp & More | <= 1.6.3 | 1.6.4 |
| WordPress-Plugin | Five-Star Ratings Shortcode | <= 1.2.56 | 1.2.57 |
| WordPress-Plugin | Notification Bar, Announcement and Cookie Notice WordPress Plugin – FooBar | <= 2.1.34 | 2.1.35 |
| WordPress-Plugin | Lightbox & Modal Popup WordPress Plugin – FooBox | <= 2.7.33 | 2.7.34 |
| WordPress-Plugin | FooGallery Photo Gallery : Image, Video & Masonry Galleries | <= 2.4.27 | 2.4.29 |
| WordPress-Plugin | Full Screen Background | <= 2.0.2 | 2.0.3 |
| WordPress-Plugin | Anti-Spam Protection – No API Key, GDPR Friendly | <= 2.3.7 | 2.3.12 |
| WordPress-Plugin | TrueAna – True Analytics Dashboard | <= 2.6.0 | 2.10.0 |
| WordPress-Plugin | Geo Mashup | <= 1.13.15 | 1.13.16 |
| WordPress-Plugin | Glossary | <= 2.2.38 | 2.2.39 |
| WordPress-Plugin | Goal Tracker – Custom Event Tracking for GA4 | <= 1.1.5 | 1.1.6 |
| WordPress-Plugin | Go Fetch Jobs (for WP Job Manager) | <= 1.8.4.8.1 | 1.8.4.9.1 |
| WordPress-Plugin | AI Puffer – AI Chatbot, AI Writer & Automation | <= 1.8.99 | 2.3.17 |
| WordPress-Plugin | Team Members – A WordPress Team Plugin with Gallery, Grid, Carousel, Slider, Table, List, and More | <= 2.5.8 | 2.6.1 |
| WordPress-Plugin | Solid Testimonials – Testimonial Slider, Video Testimonials & Customer Reviews | <= 3.2.8 | 3.2.9 |
| WordPress-Plugin | HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player | <= 2.2.27 | 2.5.1 |
| WordPress-Plugin | Inavii Social Feed – Live Social Proof Gallery | <= 2.7.0 | 2.7.7 |
| WordPress-Plugin | Independent Analytics – WordPress Analytics Plugin | <= 2.9.7 | 2.10.0 |
| WordPress-Plugin | File Manager for Google Drive – Integrate Google Drive | <= 1.4.9 | 1.5.0 |
| WordPress-Plugin | MapGeo – Interactive Geo Maps | <= 1.6.22 | 1.6.23 |
| WordPress-Plugin | Internal Link Juicer: SEO Auto Linker for WordPress | <= 2.24.6 | 2.25.2 |
| WordPress-Plugin | Joli Table Of Contents | <= 2.6.0 | 2.6.1 |
| WordPress-Plugin | Justified Gallery | <= 1.9.0 | 1.10.0 |
| WordPress-Plugin | Logo Showcase – Responsive Logo Carousel, Logo Slider & Logo Grid | <= 3.2.7 | 3.2.9 |
| WordPress-Plugin | Kikote – Location Picker at Checkout & Google Address AutoFill Plugin for WooCommerce | <= 1.10.6 | 1.10.8 |
| WordPress-Plugin | Mapster WP Maps | <= 1.9.0 | 1.21.0 |
| WordPress-Plugin | Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits | <= 2.0.7.2 | 2.0.7.3 |
| WordPress-Plugin | Menu Image, Icons made easy | <= 3.12 | 3.13 |
| WordPress-Plugin | WP Mobile Menu – The Mobile-Friendly Responsive Menu | <= 2.8.6 | 2.8.7 |
| WordPress-Plugin | Music Player for Elementor – Audio Player & Podcast Player | <= 2.4.1 | 2.4.4 |
| WordPress-Plugin | Ocean Extra | <= 2.4.2 | 2.4.4 |
| WordPress-Plugin | Open User Map – Interactive Leaflet Maps | <= 1.4.0 | 1.4.1 |
| WordPress-Plugin | PDF Poster – Let visitors read PDF's without leaving the page | <= 2.2.0 | 2.3.1 |
| WordPress-Plugin | Post List Designer – Category Post, Recent Post, Post List | <= 3.3.7 | 3.3.8 |
| WordPress-Plugin | Post Slider and Post Carousel with Post Vertical Scrolling Widget – A Responsive Post Slider | <= 3.2.8 | 3.2.9 |
| WordPress-Plugin | Post Slider and Carousel Pro | <= 2.1.2 | 2.1.3 |
| WordPress-Plugin | Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App | <= 3.0.0 | 3.1.0 |
| WordPress-Plugin | Post to Google My Business (Google Business Profile) | <= 3.1.28 | 3.2.2 |
| WordPress-Plugin | Premmerce Product Filter for WooCommerce | <= 3.7.3 | keine Korrektur |
| WordPress-Plugin | Primary Addon for Elementor | <= 1.6.0 | 1.6.5 |
| WordPress-Plugin | Product Layouts for WooCommerce | <= 1.3.1 | 1.3.5 |
| WordPress-Plugin | Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player | <= 2.0.82 | 2.0.83 |
| WordPress-Plugin | Radio Station by netmix® – Manage and play your Show Schedule in WordPress! | <= 2.5.9 | 2.5.17 |
| WordPress-Plugin | Remove Add to Cart WooCommerce | <= 1.4.7 | keine Korrektur |
| WordPress-Plugin | Restaurant & Cafe Addon for Elementor | <= 1.5.8 | 1.6.1 |
| WordPress-Plugin | Restrict – membership, site, content and user access restrictions for WordPress | <= 2.3.0 | 2.3.1 |
| WordPress-Plugin | Role Based Pricing for Woo by Meow Crew | <= 1.6.0 | 1.6.1 |
| WordPress-Plugin | Security Ninja – WordPress Security & Firewall | <= 5.222 | 5.225 |
| WordPress-Plugin | Send Users Email – Email Subscribers, Email Marketing Newsletter | <= 1.5.10 | 1.6.2 |
| WordPress-Plugin | Share This Image | <= 2.07 | 2.08 |
| WordPress-Plugin | Shortcodes Ultimate – Content Elements | <= 7.3.3 | 7.3.4 |
| WordPress-Plugin | SimpLy Gallery | <= 3.2.4.4 | 3.2.4.5 |
| WordPress-Plugin | Smart phone field for Gravity Forms | <= 2.1.6 | 2.2.0 |
| WordPress-Plugin | Carousel, Recent Post Slider and Banner Slider | <= 2.1 | 2.2 |
| WordPress-Plugin | Spotlight Social Feeds – Block, Shortcode, and Widget | <= 1.7.0 | 1.7.1 |
| WordPress-Plugin | StreamWeasels Twitch Integration | <= 1.9.2 | 1.9.3 |
| WordPress-Plugin | TablePress – Tables in WordPress made easy | <= 3.0.2 | 3.0.3 |
| WordPress-Plugin | Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent | <= 1.1.13 | 1.1.17 |
| WordPress-Plugin | Text To Speech TTS Accessibility | <= 1.7.34 | 1.8.12 |
| WordPress-Plugin | TreePress – Easy Family Trees & Ancestor Profiles | <= 3.0.6 | 3.0.7 |
| WordPress-Plugin | WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto | <= 8.0.7 | 8.0.8 |
| WordPress-Plugin | Ultimeter – the Ultimate Progress and Goals Meter | <= 3.0.5 | 3.0.7 |
| WordPress-Plugin | Unlimited Elements for Elementor | <= 1.5.140 | 1.5.141 |
| WordPress-Plugin | URL Shortify – Simple and Easy URL Shortener | <= 1.10.4 | 1.10.5.1 |
| WordPress-Plugin | Checkout with Cash App on WooCommerce | <= 6.0.2 | keine Korrektur |
| WordPress-Plugin | Payment Gateway for ACBA BANK | <= 1.2.6 | keine Korrektur |
| WordPress-Plugin | Place Order Without Payment for WooCommerce | <= 2.6.5 | 2.6.7 |
| WordPress-Plugin | Thank You Page for WooCommerce | <= 4.2.0 | 4.2.1 |
| WordPress-Plugin | Appointment Booking Plugin & Scheduling System – Webba Booking Calendar | <= 5.0.57 | 5.1.8 |
| WordPress-Plugin | Display Eventbrite Events | <= 6.1.10 | 6.1.11 |
| WordPress-Plugin | Widgets on Pages | <= 1.7 | keine Korrektur |
| WordPress-Plugin | Secure Gateway for Authorize.net and WooCommerce by Pledged Plugins | <= 6.1.13 | 6.1.14 |
| WordPress-Plugin | Pay For Post with WooCommerce | <= 3.1.26 | 3.1.28 |
| WordPress-Plugin | Disable Payment Methods based on cart conditions for WooCommerce | <= 1.16.3 | 1.16.4 |
| WordPress-Plugin | Coupon Affiliates – Affiliate Plugin for WooCommerce | <= 5.17.2 | 5.19.0 |
| WordPress-Plugin | StoreCustomizer – A plugin to Customize all WooCommerce Pages | <= 2.5.9 | 2.6.0 |
| WordPress-Plugin | XT Floating Cart for WooCommerce | <= 2.8.4 | keine Korrektur |
| WordPress-Plugin | Premmerce Permalink Manager for WooCommerce | <= 2.3.11 | keine Korrektur |
| WordPress-Plugin | RevivePress – Keep your Old Content Evergreen | <= 1.5.8 | keine Korrektur |
| WordPress-Plugin | WPBITS Addons For Elementor Page Builder | <= 1.7 | keine Korrektur |
| WordPress-Plugin | Books Gallery – Book Showcase, Library & Affiliate Plugin | <= 4.6.8 | 4.7.6 |
| WordPress-Plugin | WP Coupons and Deals – WordPress Coupon Plugin | <= 3.2.2 | 3.2.3 |
| WordPress-Plugin | WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps | <= 5.5.31 | 5.5.32 |
| WordPress-Plugin | WP fail2ban – Advanced Security | <= 5.3.4 | 5.4.0 |
| WordPress-Plugin | WPIDE – File Manager & Code Editor | <= 3.5.1 | 3.5.2 |
| WordPress-Plugin | WP Encryption – One Click SSL / HTTPS & Free SSL Certificate, HTTPS Redirect, Security | <= 7.7.0 | 7.7.3 |
| WordPress-Plugin | WP Meta and Date Remover | <= 2.3.4 | 2.3.5 |
| WordPress-Plugin | WP Notification Bell | <= 1.4.2 | 1.4.3 |
| WordPress-Plugin | WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars | <= 3.8.3 | 3.8.4 |
| WordPress-Plugin | Bulk Edit Posts and Products in Spreadsheet | <= 2.25.16 | 2.25.19 |
| WordPress-Plugin | Team Members Showcase | <= 3.3.0 | 3.3.2 |
| WordPress-Plugin | AidWP – Donation & Payment Forms (Stripe Powered) | <= 3.2.6 | 3.2.9 |
| WordPress-Plugin | TopNewsWp – Display Tikcer News, RSS Feed Widget and Many More | <= 2.4.1 | 2.4.3 |
| WordPress-Plugin | XT Quick View for WooCommerce | <= 2.1.5 | keine Korrektur |
| WordPress-Plugin | XT Variation Swatches for WooCommerce | <= 1.9.4 | 1.9.7 |
| WordPress-Plugin | YASR – Yet Another Star Rating Plugin for WordPress | <= 3.4.12 | 3.4.15 |
Verweise
CVSS-Wert
6.1/10
- CVSS-Vektor
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N- Schwäche (CWE)
CWE-79- Plattform
- WordPress
- Paket
AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading & Image Optimization, Custom WooCommerce Checkout Fields Editor, Ivory Search – WordPress Search Plugin- Veröffentlicht
- 30.04.2026
- Aktualisiert
- 11.10.2026 10:23
Quellen und Lizenzen
Wordfence Intelligence - d694491c-c0f5-4418-805a-db792ea4f712 - Wordfence Intelligence
Copyright 1999-2026 The MITRE Corporation
Copyright 2012-2026 Defiant Inc.
This record contains material that is subject to copyright
Copyright 1999-2026 The MITRE Corporation
CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.
https://www.cve.org/Legal/TermsOfUseCopyright 2012-2026 Defiant Inc.
Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.
https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/Wordfence Intelligence
Wordfence Intelligence - Defiant, Inc. Copyright Defiant, Inc. All rights reserved except as granted below. License grant, section 3.1 of the Wordfence Intelligence Terms and Conditions (January 26, 2026): Subject to this Agreement, Company hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute the Service. Any copy you make for such purposes is authorized provided that you reproduce Company’s copyright designation, this license, and the license of any disclosed Company licensor in any such copy. Full applicable Agreement: https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/
Schwachstellenhistorie: Advanced Scrollbar – Give Your Site a Sleek Branded Scrolling Feel
Alle veröffentlichten Schwachstellen dieses Pakets (WordPress-Plugin), neueste zuerst. Zeigt, ob es ein einmaliger Ausrutscher ist oder ein Paket, das man im Auge behalten muss.
- Einträge insgesamt
- 2
- Erste → letzte
- 10.2025 04.2026
- Ohne Fix
- 0
- In Angriffen ausgenutzt
- 0
Verteilung nach Schweregrad
- Hoch 1
- Mittel 1
Veröffentlichungen pro Jahr
- 2025: 1
- 2026: 1
-
Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter dieser Eintrag
Erkennen Sie Schwachstellen in Ihrer Anwendung
Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.