CVE-2024-13362: WordPress Plugins Reflected XSS Vulnerability

CVE-2024-13362 Overview

CVE-2024-13362 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting multiple WordPress plugins and themes that bundle the Freemius pricing script. The flaw resides in the handling of the url parameter, where insufficient input sanitization and output escaping allow attacker-supplied JavaScript to be reflected into rendered pages. Unauthenticated attackers can craft malicious links that execute arbitrary scripts in the victim's browser session when clicked. The vulnerability is tracked under [CWE-79] and carries a CVSS 3.1 base score of 6.1. The issue was reported by Wordfence and remediated through WordPress plugin changesets including #3229060, #3235286, and #3249130.

Critical Impact

Successful exploitation enables session hijacking, credential theft, and administrative action abuse on affected WordPress sites when an authenticated user is lured into clicking a crafted link.

Affected Products

• Multiple WordPress plugins bundling the Freemius SDK pricing script, including add-search-to-menu, featured-images-for-rss-feeds, foobox-image-lightbox, foogallery, and independent-analytics
• Additional affected plugins: interactive-geo-maps, internal-links, master-addons, menu-image, ocean-extra, pdf-poster, shortcodes-ultimate, simply-gallery-block, spotlight-social-photo-feeds, tablepress
• Further affected plugins: unlimited-elements-for-elementor, widgets-on-pages, woo-permalink-manager, wp-meta-and-date-remover, and wpide

Discovery Timeline

• 2026-05-01 - CVE-2024-13362 published to NVD
• 2026-05-01 - Last updated in NVD database

Technical Details for CVE-2024-13362

Vulnerability Analysis

The vulnerability exists within the freemius-pricing.js client-side pricing script that ships embedded across numerous WordPress plugins. When a user navigates to a plugin's pricing or upgrade page, the script reads the url query parameter and writes it back into the rendered DOM without applying adequate sanitization or output encoding. An attacker can supply a payload containing JavaScript or HTML event handlers in this parameter to achieve script execution under the origin of the WordPress site.

Reflected XSS in WordPress administrative contexts is high-impact because plugin pricing pages are commonly accessed by site administrators. Script execution in an authenticated administrator's browser can lead to plugin installation, account creation, or persistence through theme or plugin file modification. The CWE-79 classification reflects standard improper neutralization of input during web page generation.

Root Cause

The root cause is missing input sanitization and output escaping on the url parameter handled by the Freemius pricing script. The shared SDK code was reused verbatim across more than twenty plugins, propagating the same defect across the WordPress plugin ecosystem. Fixes were applied in upstream Freemius SDK updates and pulled into individual plugins through changesets #3229060, #3235286, and #3249130.

Attack Vector

Exploitation requires user interaction. The attacker crafts a URL pointing to a vulnerable plugin's pricing endpoint with a malicious payload encoded into the url parameter, then delivers it through phishing, social engineering, or a malicious referrer. When a logged-in WordPress administrator follows the link, the payload executes in the context of the WordPress origin. No authentication is required of the attacker, and the scope is changed because script execution affects content beyond the originating component.

No verified public exploit code is available. Refer to the Wordfence Threat Intel Report for technical context on the reflected vector.

Detection Methods for CVE-2024-13362

Indicators of Compromise

• HTTP requests to plugin pricing endpoints containing url= parameters with <script>, javascript:, onerror=, or other event-handler payloads
• Outbound requests from WordPress administrator browsers to attacker-controlled domains immediately after visiting a plugin pricing page
• Unexpected creation of WordPress administrator accounts, plugin installations, or modifications to wp-config.php and theme files following an admin session
• Web server access logs showing referrers from external sites linking directly into freemius-pricing.js consuming pages

Detection Strategies

• Inspect web application firewall (WAF) and reverse proxy logs for requests to /wp-admin/admin.php pages associated with affected plugins carrying suspicious url parameter values
• Deploy content security policy (CSP) reporting to surface inline script execution attempts on WordPress admin pages
• Hunt for the string freemius-pricing.js combined with non-URL characters in the url query parameter across HTTP telemetry

Monitoring Recommendations

• Enable verbose access logging on /wp-admin/ paths and forward to a centralized log analytics platform for query-based hunting
• Monitor WordPress audit logs for administrative actions occurring within seconds of a pricing page visit, which can indicate XSS-driven CSRF chaining
• Track installed plugin versions across managed WordPress fleets and alert on versions predating the relevant Freemius SDK fix

How to Mitigate CVE-2024-13362

Immediate Actions Required

• Update every affected plugin to the latest version that incorporates the patched Freemius SDK, referencing changesets #3229060, #3235286, and #3249130
• Audit installed WordPress plugins against the affected list and remove any plugins that are no longer needed or maintained
• Force re-authentication of all WordPress administrator accounts and rotate session cookies after patching

Patch Information

Fixes were committed to the WordPress plugin repository through Changeset #3229060, Changeset #3235286, and Changeset #3249130. Plugin maintainers updated the bundled Freemius SDK pricing script to properly sanitize and escape the url parameter. Site operators should apply plugin updates from the WordPress plugin directory rather than patching freemius-pricing.js manually.

Workarounds

• Restrict access to /wp-admin/ to known administrator IP addresses through web server or WAF allowlists until patches are applied
• Configure a strict Content Security Policy that disallows inline script execution and untrusted script sources on WordPress admin pages
• Disable or uninstall affected plugins that cannot be promptly updated
• Train administrators to avoid clicking links to plugin pricing or upgrade pages from untrusted sources

# Example: enforce CSP header for /wp-admin via Nginx
location ^~ /wp-admin/ {
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
}