Średnia
Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Czego dotyczy
Kliknij technologię, aby zobaczyć wszystkie dotyczące jej podatności.
| Platforma | Paczka | Podatne wersje | Poprawka w wersji |
|---|---|---|---|
| Wtyczka WordPress | AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading & Image Optimization | <= 2.9.2 | 2.10.0 |
| Wtyczka WordPress | Custom WooCommerce Checkout Fields Editor | <= 1.3.4 | brak poprawki |
| Wtyczka WordPress | Ivory Search – WordPress Search Plugin | <= 5.5.8 | 5.5.9 |
| Wtyczka WordPress | Advanced Classifieds & Directory Pro | <= 3.2.4 | 3.2.5 |
| Wtyczka WordPress | Advanced Scrollbar – Give Your Site a Sleek Branded Scrolling Feel | <= 1.1.3 | 1.1.10 |
| Wtyczka WordPress | AWCA – The Great Analytics Insights for Your eStore | <= 3.12.0 | 3.16.0 |
| Wtyczka WordPress | AI Bud – AI Content Generator, AI Chatbot, ChatGPT, Gemini, GPT-4o | <= 1.7.2 | 1.8.5 |
| Wtyczka WordPress | Image Alt Text Manager – Bulk & Dynamic Alt Tags For image SEO Optimization + AI | <= 1.6.3 | 1.6.6 |
| Wtyczka WordPress | Auto-Install Free SSL – Generate & Install Free SSL Certificates | <= 4.5.0 | 4.5.1 |
| Wtyczka WordPress | Automatic Internal Links for SEO by Pagup | <= 2.0.0 | 2.0.1 |
| Wtyczka WordPress | Automatic YouTube Gallery – Embed Auto-Updating YouTube Video Galleries, Feeds, Playlists & Channels | <= 2.5.5 | 2.5.6 |
| Wtyczka WordPress | Knowledge Base documentation & wiki plugin – BasePress Docs | <= 2.16.3.3 | 2.16.3.6 |
| Wtyczka WordPress | bBlocks – Essential Gutenberg Blocks & Patterns Collection | <= 1.9.8 | 2.0.19 |
| Wtyczka WordPress | Forumax – AI Powered Advanced Community Forum Plugin | <= 1.2.7 | 1.2.9 |
| Wtyczka WordPress | BlockSpare – Gutenberg Blocks, AI Content Generator & Site Builder for news, magazine, blog and business sites | <= 3.2.6 | 3.2.8 |
| Wtyczka WordPress | Blog Designer Pack – Blog, Post Grid, Post Slider, Post Carousel, Category Post, News | <= 3.4.9 | 3.4.11 |
| Wtyczka WordPress | Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots | <= 2.6.7 | 2.7.0 |
| Wtyczka WordPress | Bulk Auto Image Alt Text (Alt tag, Alt attribute) optimizer (image SEO) | <= 2.1.0 | 2.2.0 |
| Wtyczka WordPress | Announcement & Notification Banner – Bulletin | <= 3.12.1 | 3.13.1 |
| Wtyczka WordPress | Message Filter for Contact Form 7 | <= 1.6.3.2 | 1.6.3.3 |
| Wtyczka WordPress | WOW Styler for CF7 – Visual Styler for Contact Form 7 Forms | <= 1.7.0 | 1.7.1 |
| Wtyczka WordPress | Code Manager | <= 1.0.40 | 1.0.41 |
| Wtyczka WordPress | Webheadcoder Multi-Step Forms for Contact Form 7 | <= 4.4.1 | 4.4.2 |
| Wtyczka WordPress | WP Page Templates | <= 1.1.16 | 1.1.17 |
| Wtyczka WordPress | Custom PHP Settings | <= 2.3.1 | 2.3.2 |
| Wtyczka WordPress | Auto Post Cleaner | <= 3.9.6 | 3.9.7 |
| Wtyczka WordPress | Meta Field Block – Display Custom Fields for ACF, Meta Box and More | <= 1.3.3 | 1.3.4 |
| Wtyczka WordPress | Dracula Dark Mode – Accessibility, Reading Mode & Dark Mode for WordPress | <= 1.2.7 | 1.2.8 |
| Wtyczka WordPress | Dynamic Copyright Year | <= 1.0.4 | 1.1 |
| Wtyczka WordPress | Easy Age Verify | <= 1.8.5 | 1.9 |
| Wtyczka WordPress | Easy Social Feed – Social Wall, Photos Gallery and Post Feed for WordPress | <= 6.6.5 | 6.6.6 |
| Wtyczka WordPress | Marijuana Age Verify | <= 1.5.5 | 1.6 |
| Wtyczka WordPress | EazyDocs – AI Powered Knowledge Base, Wiki, Documentation & FAQ Builder | <= 2.5.7 | 2.5.9 |
| Wtyczka WordPress | EleSpare – News, Magazine and Blog Addons for Elementor | <= 3.3.2 | 3.3.4 |
| Wtyczka WordPress | Embedder for Google Reviews | <= 1.6.6 | 1.7.5 |
| Wtyczka WordPress | Events Addon for Elementor | <= 2.2.2 | 2.2.5 |
| Wtyczka WordPress | Featured Images in RSS for Mailchimp & More | <= 1.6.3 | 1.6.4 |
| Wtyczka WordPress | Five-Star Ratings Shortcode | <= 1.2.56 | 1.2.57 |
| Wtyczka WordPress | Notification Bar, Announcement and Cookie Notice WordPress Plugin – FooBar | <= 2.1.34 | 2.1.35 |
| Wtyczka WordPress | Lightbox & Modal Popup WordPress Plugin – FooBox | <= 2.7.33 | 2.7.34 |
| Wtyczka WordPress | FooGallery Photo Gallery : Image, Video & Masonry Galleries | <= 2.4.27 | 2.4.29 |
| Wtyczka WordPress | Full Screen Background | <= 2.0.2 | 2.0.3 |
| Wtyczka WordPress | Anti-Spam Protection – No API Key, GDPR Friendly | <= 2.3.7 | 2.3.12 |
| Wtyczka WordPress | TrueAna – True Analytics Dashboard | <= 2.6.0 | 2.10.0 |
| Wtyczka WordPress | Geo Mashup | <= 1.13.15 | 1.13.16 |
| Wtyczka WordPress | Glossary | <= 2.2.38 | 2.2.39 |
| Wtyczka WordPress | Goal Tracker – Custom Event Tracking for GA4 | <= 1.1.5 | 1.1.6 |
| Wtyczka WordPress | Go Fetch Jobs (for WP Job Manager) | <= 1.8.4.8.1 | 1.8.4.9.1 |
| Wtyczka WordPress | AI Puffer – AI Chatbot, AI Writer & Automation | <= 1.8.99 | 2.3.17 |
| Wtyczka WordPress | Team Members – A WordPress Team Plugin with Gallery, Grid, Carousel, Slider, Table, List, and More | <= 2.5.8 | 2.6.1 |
| Wtyczka WordPress | Solid Testimonials – Testimonial Slider, Video Testimonials & Customer Reviews | <= 3.2.8 | 3.2.9 |
| Wtyczka WordPress | HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player | <= 2.2.27 | 2.5.1 |
| Wtyczka WordPress | Inavii Social Feed – Live Social Proof Gallery | <= 2.7.0 | 2.7.7 |
| Wtyczka WordPress | Independent Analytics – WordPress Analytics Plugin | <= 2.9.7 | 2.10.0 |
| Wtyczka WordPress | File Manager for Google Drive – Integrate Google Drive | <= 1.4.9 | 1.5.0 |
| Wtyczka WordPress | MapGeo – Interactive Geo Maps | <= 1.6.22 | 1.6.23 |
| Wtyczka WordPress | Internal Link Juicer: SEO Auto Linker for WordPress | <= 2.24.6 | 2.25.2 |
| Wtyczka WordPress | Joli Table Of Contents | <= 2.6.0 | 2.6.1 |
| Wtyczka WordPress | Justified Gallery | <= 1.9.0 | 1.10.0 |
| Wtyczka WordPress | Logo Showcase – Responsive Logo Carousel, Logo Slider & Logo Grid | <= 3.2.7 | 3.2.9 |
| Wtyczka WordPress | Kikote – Location Picker at Checkout & Google Address AutoFill Plugin for WooCommerce | <= 1.10.6 | 1.10.8 |
| Wtyczka WordPress | Mapster WP Maps | <= 1.9.0 | 1.21.0 |
| Wtyczka WordPress | Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits | <= 2.0.7.2 | 2.0.7.3 |
| Wtyczka WordPress | Menu Image, Icons made easy | <= 3.12 | 3.13 |
| Wtyczka WordPress | WP Mobile Menu – The Mobile-Friendly Responsive Menu | <= 2.8.6 | 2.8.7 |
| Wtyczka WordPress | Music Player for Elementor – Audio Player & Podcast Player | <= 2.4.1 | 2.4.4 |
| Wtyczka WordPress | Ocean Extra | <= 2.4.2 | 2.4.4 |
| Wtyczka WordPress | Open User Map – Interactive Leaflet Maps | <= 1.4.0 | 1.4.1 |
| Wtyczka WordPress | PDF Poster – Let visitors read PDF's without leaving the page | <= 2.2.0 | 2.3.1 |
| Wtyczka WordPress | Post List Designer – Category Post, Recent Post, Post List | <= 3.3.7 | 3.3.8 |
| Wtyczka WordPress | Post Slider and Post Carousel with Post Vertical Scrolling Widget – A Responsive Post Slider | <= 3.2.8 | 3.2.9 |
| Wtyczka WordPress | Post Slider and Carousel Pro | <= 2.1.2 | 2.1.3 |
| Wtyczka WordPress | Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App | <= 3.0.0 | 3.1.0 |
| Wtyczka WordPress | Post to Google My Business (Google Business Profile) | <= 3.1.28 | 3.2.2 |
| Wtyczka WordPress | Premmerce Product Filter for WooCommerce | <= 3.7.3 | brak poprawki |
| Wtyczka WordPress | Primary Addon for Elementor | <= 1.6.0 | 1.6.5 |
| Wtyczka WordPress | Product Layouts for WooCommerce | <= 1.3.1 | 1.3.5 |
| Wtyczka WordPress | Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player | <= 2.0.82 | 2.0.83 |
| Wtyczka WordPress | Radio Station by netmix® – Manage and play your Show Schedule in WordPress! | <= 2.5.9 | 2.5.17 |
| Wtyczka WordPress | Remove Add to Cart WooCommerce | <= 1.4.7 | brak poprawki |
| Wtyczka WordPress | Restaurant & Cafe Addon for Elementor | <= 1.5.8 | 1.6.1 |
| Wtyczka WordPress | Restrict – membership, site, content and user access restrictions for WordPress | <= 2.3.0 | 2.3.1 |
| Wtyczka WordPress | Role Based Pricing for Woo by Meow Crew | <= 1.6.0 | 1.6.1 |
| Wtyczka WordPress | Security Ninja – WordPress Security & Firewall | <= 5.222 | 5.225 |
| Wtyczka WordPress | Send Users Email – Email Subscribers, Email Marketing Newsletter | <= 1.5.10 | 1.6.2 |
| Wtyczka WordPress | Share This Image | <= 2.07 | 2.08 |
| Wtyczka WordPress | Shortcodes Ultimate – Content Elements | <= 7.3.3 | 7.3.4 |
| Wtyczka WordPress | SimpLy Gallery | <= 3.2.4.4 | 3.2.4.5 |
| Wtyczka WordPress | Smart phone field for Gravity Forms | <= 2.1.6 | 2.2.0 |
| Wtyczka WordPress | Carousel, Recent Post Slider and Banner Slider | <= 2.1 | 2.2 |
| Wtyczka WordPress | Spotlight Social Feeds – Block, Shortcode, and Widget | <= 1.7.0 | 1.7.1 |
| Wtyczka WordPress | StreamWeasels Twitch Integration | <= 1.9.2 | 1.9.3 |
| Wtyczka WordPress | TablePress – Tables in WordPress made easy | <= 3.0.2 | 3.0.3 |
| Wtyczka WordPress | Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent | <= 1.1.13 | 1.1.17 |
| Wtyczka WordPress | Text To Speech TTS Accessibility | <= 1.7.34 | 1.8.12 |
| Wtyczka WordPress | TreePress – Easy Family Trees & Ancestor Profiles | <= 3.0.6 | 3.0.7 |
| Wtyczka WordPress | WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto | <= 8.0.7 | 8.0.8 |
| Wtyczka WordPress | Ultimeter – the Ultimate Progress and Goals Meter | <= 3.0.5 | 3.0.7 |
| Wtyczka WordPress | Unlimited Elements for Elementor | <= 1.5.140 | 1.5.141 |
| Wtyczka WordPress | URL Shortify – Simple and Easy URL Shortener | <= 1.10.4 | 1.10.5.1 |
| Wtyczka WordPress | Checkout with Cash App on WooCommerce | <= 6.0.2 | brak poprawki |
| Wtyczka WordPress | Payment Gateway for ACBA BANK | <= 1.2.6 | brak poprawki |
| Wtyczka WordPress | Place Order Without Payment for WooCommerce | <= 2.6.5 | 2.6.7 |
| Wtyczka WordPress | Thank You Page for WooCommerce | <= 4.2.0 | 4.2.1 |
| Wtyczka WordPress | Appointment Booking Plugin & Scheduling System – Webba Booking Calendar | <= 5.0.57 | 5.1.8 |
| Wtyczka WordPress | Display Eventbrite Events | <= 6.1.10 | 6.1.11 |
| Wtyczka WordPress | Widgets on Pages | <= 1.7 | brak poprawki |
| Wtyczka WordPress | Secure Gateway for Authorize.net and WooCommerce by Pledged Plugins | <= 6.1.13 | 6.1.14 |
| Wtyczka WordPress | Pay For Post with WooCommerce | <= 3.1.26 | 3.1.28 |
| Wtyczka WordPress | Disable Payment Methods based on cart conditions for WooCommerce | <= 1.16.3 | 1.16.4 |
| Wtyczka WordPress | Coupon Affiliates – Affiliate Plugin for WooCommerce | <= 5.17.2 | 5.19.0 |
| Wtyczka WordPress | StoreCustomizer – A plugin to Customize all WooCommerce Pages | <= 2.5.9 | 2.6.0 |
| Wtyczka WordPress | XT Floating Cart for WooCommerce | <= 2.8.4 | brak poprawki |
| Wtyczka WordPress | Premmerce Permalink Manager for WooCommerce | <= 2.3.11 | brak poprawki |
| Wtyczka WordPress | RevivePress – Keep your Old Content Evergreen | <= 1.5.8 | brak poprawki |
| Wtyczka WordPress | WPBITS Addons For Elementor Page Builder | <= 1.7 | brak poprawki |
| Wtyczka WordPress | Books Gallery – Book Showcase, Library & Affiliate Plugin | <= 4.6.8 | 4.7.6 |
| Wtyczka WordPress | WP Coupons and Deals – WordPress Coupon Plugin | <= 3.2.2 | 3.2.3 |
| Wtyczka WordPress | WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps | <= 5.5.31 | 5.5.32 |
| Wtyczka WordPress | WP fail2ban – Advanced Security | <= 5.3.4 | 5.4.0 |
| Wtyczka WordPress | WPIDE – File Manager & Code Editor | <= 3.5.1 | 3.5.2 |
| Wtyczka WordPress | WP Encryption – One Click SSL / HTTPS & Free SSL Certificate, HTTPS Redirect, Security | <= 7.7.0 | 7.7.3 |
| Wtyczka WordPress | WP Meta and Date Remover | <= 2.3.4 | 2.3.5 |
| Wtyczka WordPress | WP Notification Bell | <= 1.4.2 | 1.4.3 |
| Wtyczka WordPress | WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars | <= 3.8.3 | 3.8.4 |
| Wtyczka WordPress | Bulk Edit Posts and Products in Spreadsheet | <= 2.25.16 | 2.25.19 |
| Wtyczka WordPress | Team Members Showcase | <= 3.3.0 | 3.3.2 |
| Wtyczka WordPress | AidWP – Donation & Payment Forms (Stripe Powered) | <= 3.2.6 | 3.2.9 |
| Wtyczka WordPress | TopNewsWp – Display Tikcer News, RSS Feed Widget and Many More | <= 2.4.1 | 2.4.3 |
| Wtyczka WordPress | XT Quick View for WooCommerce | <= 2.1.5 | brak poprawki |
| Wtyczka WordPress | XT Variation Swatches for WooCommerce | <= 1.9.4 | 1.9.7 |
| Wtyczka WordPress | YASR – Yet Another Star Rating Plugin for WordPress | <= 3.4.12 | 3.4.15 |
Odnośniki
Ocena CVSS
6.1/10
- Wektor CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N- Słabość (CWE)
CWE-79- Platforma
- WordPress
- Paczka
AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading & Image Optimization, Custom WooCommerce Checkout Fields Editor, Ivory Search – WordPress Search Plugin- Ujawniono
- 30.04.2026
- Aktualizacja
- 11.10.2026 10:23
Źródła i licencje
Wordfence Intelligence - d694491c-c0f5-4418-805a-db792ea4f712 - Wordfence Intelligence
Copyright 1999-2026 The MITRE Corporation
Copyright 2012-2026 Defiant Inc.
This record contains material that is subject to copyright
Copyright 1999-2026 The MITRE Corporation
CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.
https://www.cve.org/Legal/TermsOfUseCopyright 2012-2026 Defiant Inc.
Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.
https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/Wordfence Intelligence
Wordfence Intelligence - Defiant, Inc. Copyright Defiant, Inc. All rights reserved except as granted below. License grant, section 3.1 of the Wordfence Intelligence Terms and Conditions (January 26, 2026): Subject to this Agreement, Company hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute the Service. Any copy you make for such purposes is authorized provided that you reproduce Company’s copyright designation, this license, and the license of any disclosed Company licensor in any such copy. Full applicable Agreement: https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/
Historia podatności: AI Bud – AI Content Generator, AI Chatbot, ChatGPT, Gemini, GPT-4o
Wszystkie opisane podatności tej paczki (Wtyczka WordPress), od najnowszej. Widać, czy to jednorazowa wpadka, czy paczka, której trzeba pilnować.
- Wszystkich wpisów
- 2
- Pierwsza → ostatnia
- 07.2025 04.2026
- Bez poprawki
- 1
- Wykorzystywana w atakach
- 0
Rozkład istotności
- Wysoka 1
- Średnia 1
Ujawnienia w latach
- 2025: 1
- 2026: 1
-
Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter ten wpis
Dowiedz się, które podatności dotyczą Twojej aplikacji
Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.