{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2024-13362 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2024-13362 yet. Limit exposure of the affected software until one is available.","what":"CVE-2024-13362 is a medium-severity cross-site scripting vulnerability in 100plugins AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading \u0026 Image Optimization, published on 1 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2024-13362 and fix it if it is affected.\n\nWhat it is: CVE-2024-13362 is a medium-severity cross-site scripting vulnerability in 100plugins AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading \u0026 Image Optimization, published on 1 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of CVE-2024-13362 in the wild and no public exploit code.\n\nAffected product: 100plugins AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading \u0026 Image Optimization. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-13362/ (Markdown: https://insights.sbomify.com/CVE-2024-13362/index.md)","id":"CVE-2024-13362","markdown":"https://insights.sbomify.com/CVE-2024-13362/index.md","name":"CVE-2024-13362","record":{"aliases":["GHSA-c7cj-88jr-mhx2"],"analysis":{"component_type":"cms_plugin","fix_type":"upgrade","impacts":["code_execution"],"network_reachable":"yes","non_default_config":false,"product_category":"WordPress plugins","requires_auth":"none","summary":"Unauthenticated attackers can inject arbitrary scripts via the url parameter in multiple WordPress plugins, requiring user interaction to execute.","user_interaction":"required","vuln_class":"xss"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Wordfence","cpe":[],"cvss":{"score":6.1,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"description":"Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":null,"headline":"Freemius \u003c= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter","id":"CVE-2024-13362","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"xss","year":"2024"},"n_packages":0,"n_references":24,"next":{"headline":"Raptive Ads \u003c= 3.6.3 - Reflected Cross-Site Scripting","id":"CVE-2024-13363"},"packages":[],"prev":{"headline":"Missing authorization in AI Puffer – Your AI engine for WordPress (formerly AI Power)","id":"CVE-2024-13361"},"products":["AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading \u0026 Image Optimization","AI Bud – AI Content Generator, AI Chatbot, ChatGPT, Gemini, GPT-4o","AI Puffer – Chat. Create. Automate. (formerly AI Power)","AWCA – The Great Analytics Insights for Your eStore","Advanced Classifieds \u0026 Directory Pro","Advanced Scrollbar – Custom Scrollbar Styling and Behavior","AidWP – Donation \u0026 Payment Forms (Stripe Powered)","Announcement \u0026 Notification Banner – Bulletin","Anti-Spam Protection – No API Key, GDPR Friendly","Auto-Install Free SSL – Generate \u0026 Install Free SSL Certificates","Automatic Internal Links for SEO by Pagup","Automatic YouTube Gallery","Better Messages – Live Chat, Chat Rooms, Real-Time Messaging \u0026 Private Messages","BlockSpare — News, Magazine and Blog Addons for (Gutenberg) Block Editor","Blog Designer Pack – Blog, Post Grid, Post Slider, Post Carousel, Category Post, News","Bulk Auto Image Alt Text (Alt tag, Alt attribute) optimizer (image SEO)","Bulk Edit Posts and Products in Spreadsheet","Carousel, Recent Post Slider and Banner Slider","Checkout with Cash App on WooCommerce","Code Manager","Contact Form 7 Multi-Step Forms","Coupon Affiliates – Affiliate Plugin for WooCommerce","Custom PHP Settings","Custom WooCommerce Checkout Fields Editor","Delete Posts automatically","Disable Payment Methods based on cart conditions for WooCommerce","Display Eventbrite Events","Dracula Dark Mode –  Accessibility, Reading Mode \u0026 Dark Mode for WordPress","Dynamic Copyright Year","Easy Age Verify","Easy Appointment Booking \u0026 Scheduling System – Webba Booking Calendar","Easy Social Feed – Social Photos Gallery and Post Feed for WordPress","EazyDocs – AI Powered Knowledge Base, Wiki, Documentation \u0026 FAQ Builder","EleSpare – News, Magazine and Blog Addons for Elementor","Embedder for Google Reviews","Events Addon for Elementor","Featured Images in RSS for Mailchimp \u0026 More","File Manager for Google Drive – Integrate Google Drive","Five-Star Ratings Shortcode","Forumax – AI Powered Advanced Community Forum Plugin","Full Screen Background","GA4WP – Analytics Dashboard for the Website","Gallery by FooGallery","Geo Mashup","Glossary","Go Fetch Jobs (for WP Job Manager)","Goal Tracker – Custom Event Tracking for GA4","HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 \u0026 Audio Player","Image Alt Text Manager – Bulk \u0026 Dynamic Alt Tags For image SEO Optimization + AI","Inavii Social Feed","Independent Analytics","Internal Link Juicer: SEO Auto Linker for WordPress","Ivory Search – WordPress Search Plugin","Joli Table Of Contents","Justified Gallery","Kikote – Location Picker at Checkout \u0026 Google Address AutoFill Plugin for WooCommerce","Knowledge Base documentation \u0026 wiki plugin – BasePress Docs","Lightbox \u0026 Modal Popup WordPress Plugin – FooBox","Logo Showcase – Responsive Logo Carousel, Logo Slider \u0026 Logo Grid","MapGeo – Interactive Geo Maps","Mapster WP Maps","Marijuana Age Verify","Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder \u0026 Template Kits","Menu Image, Icons made easy","Message Filter for Contact Form 7","Meta Field Block – Display custom fields in the Block Editor without coding","Mixed Media Gallery Blocks","Music Player for Elementor – Audio Player \u0026 Podcast Player","Notification Bar, Announcement and Cookie Notice WordPress Plugin – FooBar","Ocean Extra","Open User Map","PDF Poster – Display PDF Files with Custom Viewer","Pay For Post with WooCommerce","Payment Gateway for ACBA BANK","Place Order Without Payment for WooCommerce","Post List Designer – Category Post, Recent Post, Post List","Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP \u0026 Mobile App","Post Slider and Post Carousel with Post Vertical Scrolling Widget – A Responsive Post Slider","Post to Google My Business (Google Business Profile)","Premmerce Permalink Manager for WooCommerce","Premmerce Product Filter for WooCommerce","Primary Addon for Elementor","Product Layouts for WooCommerce","Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player","Radio Station by netmix® – Manage and play your Show Schedule in WordPress!","Remove Add to Cart WooCommerce","Restaurant \u0026 Cafe Addon for Elementor","Restrict – membership, site, content and user access restrictions for WordPress","RevivePress – Keep your Old Content Evergreen","Role Based Pricing for Woo by Meow Crew","Secure Gateway for Authorize.net and WooCommerce by Pledged Plugins","Security Ninja – WordPress Security \u0026 Firewall","Send Users Email – Email Subscribers, Email Marketing Newsletter","Share This Image","Smart phone field for Gravity Forms","Solid Testimonials – Testimonial Slider, Video Testimonials \u0026 Customer Reviews","Spotlight Social Feeds – Block, Shortcode, and Widget","StoreCustomizer – A plugin to Customize all WooCommerce Pages","StreamWeasels Twitch Integration","TablePress – Tables in WordPress made easy","Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent","Team Members Showcase","Team Members – A WordPress Team Plugin with Gallery, Grid, Carousel, Slider, Table, List, and More","Text To Speech TTS Accessibility","Thank You Page for WooCommerce","TopNewsWp – Display Tikcer News, RSS Feed Widget and Many More","TreePress – Easy Family Trees \u0026 Ancestor Profiles","URL Shortify – Simple and Easy URL Shortener","Ultimeter","Unlimited Elements For Elementor","WOW Styler for CF7 – Visual Styler for Contact Form 7 Forms","WP Books Gallery – Build Stunning Book Showcases \u0026 Libraries in Minutes","WP Coupons and Deals – Coupon Plugin For Affiliate Marketers","WP Data Access – App Builder for Tables, Forms, Charts, Maps \u0026 Dashboards","WP Encryption – One Click Free SSL Certificate \u0026 SSL / HTTPS Redirect, Security \u0026 SSL Scan","WP Meta and Date Remover","WP Mobile Menu – The Mobile-Friendly Responsive Menu","WP Notification Bell","WP Page Templates","WP Post Author – Author Box, Multiple Authors, Guest Authors \u0026 Custom Avatars","WP Shortcodes Plugin — Shortcodes Ultimate","WP fail2ban – Advanced Security","WPBITS Addons For Elementor Page Builder","WPIDE – File Manager \u0026 Code Editor","Widgets on Pages","WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto","XT Floating Cart for WooCommerce","XT Quick View for WooCommerce","XT Variation Swatches for WooCommerce","YASR – Yet Another Star Rating Plugin for WordPress","bBlocks – Essential Gutenberg Blocks \u0026 Patterns Collection"],"published":"2026-05-01","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-05-01","vendors":["100plugins","5starplugins","afthemes","bensibley","blackandwhitedigital","blockspare","bouncingsprout","bplugins","cleverplugins","codesavory","cyberhobo","cyclonecode","damian-gora","dashlabsltd","davidanderson","elespare","elliotvs","enweby","essekia","fooplugins","fullworks","gallerycreator","gn_themes","gowebsmarty","hasanazizul","hkdigitalagency","imtiazrayhan","inavii","infornweb","infosatech","interactivegeomaps","invisnet","josevega","kaira","kaizencoders","koen12344","kofimokome","litonice13","mapster","mattpramschufer","meowcrew","mhmrajib","mihail-barinov","mikewire_rocksolid","mohsinoffline","mr2p","mte90","nicheaddons","nitin247","oceanwp","oxilab","pagup","paretodigital","passionatebrains","peterschulznl","pluginandplay","plugins360","pluginscafe","pluginsware","prasadkirpekar","premmerce","princeahmed","rebelcode","saadiqbal","samdani","sebet","seezee","senols","sjaved","smartwpress","speedify","spicethemes","spiderdevs","streamweasels","takanakui","theafricanboss","themelocation","tickera","tobias_conrad","tobiasbg","toddhalfpenny","tonyzeoli","tripetto","unitecms","uriahs-victor","vinod-dalvi","webba-agency","webfactory","webheadllc","wordplus","wpbits","wpdever","wpjoli","wpmagics","wpsaad","wpspeedo","xplodedthemes","yuvalo"]},"summary":"Unauthenticated attackers can inject arbitrary scripts via the url parameter in multiple WordPress plugins, requiring user interaction to execute.","url":"https://insights.sbomify.com/CVE-2024-13362/"}