CVE-2024-13362: 100plugins open_user_map Cross-site Scripting

CVSS: 6.1v3.1MediumDeferred

Published 01-05-2026Last modified 01-05-2026

Vulnerability summary

CVE-2024-13362 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in 100plugins open_user_map. EPSS estimates a 0.28% chance of exploitation in the next 30 days, higher than 18.8% of scored vulnerabilities.

Overall risk

24/100

0100

Low · default modelHow is this calculated?

CVSS score

6.1/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.28%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Timeline

01-05-2026
PublishedVulnerability first disclosed.
01-05-2026
Last modifiedVulnerability information updated.

Description

Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

CVSS metrics

3 scores · 3 sources · 1 version

v3.16.1

EPSS trend

Probability

0.28%

Chance of exploitation in the next 30 days

Percentile

19%

Versus all other CVEs

30-day change

0.00 pp

From 0.28% on 19-09-2026

19-09-202619-10-2026

EPSS score

0.28%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Affected systems

Wordpress80 products

add-expires-headers≤ 2.9.2 (fixed in 2.10.0)
add-fields-to-checkout-page-woocommerce≤ 1.3.4
add-search-to-menu≤ 5.5.8 (fixed in 5.5.9)
advance-wc-analytics≤ 3.12.0 (fixed in 3.16.0)
advanced-classifieds-and-directory-pro≤ 3.2.4 (fixed in 3.2.5)

advanced-scrollbar≤ 1.1.3 (fixed in 1.1.10)
aibuddy-openai-chatgpt≤ 1.7.2 (fixed in 1.8.5)
alt-manager≤ 1.6.3 (fixed in 1.6.6)
auto-install-free-ssl≤ 4.5.0 (fixed in 4.5.1)
automatic-internal-links-for-seo≤ 2.0.0 (fixed in 2.0.1)
automatic-youtube-gallery≤ 2.5.5 (fixed in 2.5.6)
b-blocks≤ 1.9.8 (fixed in 2.0.19)
basepress≤ 2.16.3.3 (fixed in 2.16.3.6)
bbp-core≤ 1.2.7 (fixed in 1.2.9)
blockspare≤ 3.2.6 (fixed in 3.2.8)
blog-designer-pack≤ 3.4.9 (fixed in 3.4.11)
bp-better-messages≤ 2.6.7 (fixed in 2.7.0)
bulk-image-alt-text-with-yoast≤ 2.1.0 (fixed in 2.2.0)
bulletin-announcements≤ 3.12.1 (fixed in 3.13.1)
cf7-message-filter≤ 1.6.3.2 (fixed in 1.6.3.3)
cf7-styler≤ 1.7.0 (fixed in 1.7.1)
code-manager≤ 1.0.40 (fixed in 1.0.41)
contact-form-7-multi-step-module≤ 4.4.1 (fixed in 4.4.2)
custom-page-templates-by-vegacorp≤ 1.1.16 (fixed in 1.1.17)
custom-php-settings≤ 2.3.1 (fixed in 2.3.2)
delete-old-posts-programmatically≤ 3.9.6 (fixed in 3.9.7)
display-a-meta-field-as-block≤ 1.3.3 (fixed in 1.3.4)
dracula-dark-mode≤ 1.2.7 (fixed in 1.2.8)
dynamic-copyright-year≤ 1.0.4 (fixed in 1.1)
easy-age-verify≤ 1.8.5 (fixed in 1.9)
easy-facebook-likebox≤ 6.6.5 (fixed in 6.6.6)
easy-marijuana-age-verify≤ 1.5.5 (fixed in 1.6)
eazydocs≤ 2.5.7 (fixed in 2.5.9)
elespare≤ 3.3.2 (fixed in 3.3.4)
embedder-for-google-reviews≤ 1.6.6 (fixed in 1.7.5)
events-addon-for-elementor≤ 2.2.2 (fixed in 2.2.5)
featured-images-for-rss-feeds≤ 1.6.3 (fixed in 1.6.4)
five-star-ratings-shortcode≤ 1.2.56 (fixed in 1.2.57)
foobar-notifications-lite≤ 2.1.34 (fixed in 2.1.35)
foobox-image-lightbox≤ 2.7.33 (fixed in 2.7.34)
foogallery≤ 2.4.27 (fixed in 2.4.29)
fullscreen-background≤ 2.0.2 (fixed in 2.0.3)
fullworks-anti-spam≤ 2.3.7 (fixed in 2.3.12)
ga-for-wp≤ 2.6.0 (fixed in 2.10.0)
geo-mashup≤ 1.13.15 (fixed in 1.13.16)
glossary-by-codeat≤ 2.2.38 (fixed in 2.2.39)
go-fetch-jobs-wp-job-manager≤ 1.8.4.8.1 (fixed in 1.8.4.9.1)
goal-tracker-ga≤ 1.1.5 (fixed in 1.1.6)
gpt3-ai-content-generator≤ 1.8.99 (fixed in 2.3.17)
gs-team-members≤ 2.5.8 (fixed in 2.6.1)
gs-testimonial≤ 3.2.8 (fixed in 3.2.9)
html5-audio-player≤ 2.2.27 (fixed in 2.5.1)
inavii-social-feed-for-elementor≤ 2.7.0 (fixed in 2.7.7)
independent-analytics≤ 2.9.7 (fixed in 2.10.0)
integrate-google-drive≤ 1.4.9 (fixed in 1.5.0)
interactive-geo-maps≤ 1.6.22 (fixed in 1.6.23)
internal-links≤ 2.24.6 (fixed in 2.25.2)
joli-table-of-contents≤ 2.6.0 (fixed in 2.6.1)
justified-gallery≤ 1.9.0 (fixed in 1.10.0)
logo-showcase-with-slick-slider≤ 3.2.7 (fixed in 3.2.9)
map-location-picker-at-checkout-for-woocommerce≤ 1.10.6 (fixed in 1.10.8)
mapster-wp-maps≤ 1.9.0 (fixed in 1.21.0)
master-addons≤ 2.0.7.2 (fixed in 2.0.7.3)
menu-image≤ 3.12 (fixed in 3.13)
mobile-menu≤ 2.8.6 (fixed in 2.8.7)
music-player-for-elementor≤ 2.4.1 (fixed in 2.4.4)
ocean-extra≤ 2.4.2 (fixed in 2.4.4)
open-user-map≤ 1.4.0 (fixed in 1.4.1)
pdf-poster≤ 2.2.0 (fixed in 2.3.1)
post-list-designer≤ 3.3.7 (fixed in 3.3.8)
post-slider-and-carousel≤ 3.2.8 (fixed in 3.2.9)
post-slider-and-carousel-pro≤ 2.1.2 (fixed in 2.1.3)
post-smtp≤ 3.0.0 (fixed in 3.1.0)
post-to-google-my-business≤ 3.1.28 (fixed in 3.2.2)
premmerce-woocommerce-product-filter≤ 3.7.3
primary-addon-for-elementor≤ 1.6.0 (fixed in 1.6.5)
product-layouts≤ 1.3.1 (fixed in 1.3.5)
radio-player≤ 2.0.82 (fixed in 2.0.83)
radio-station≤ 2.5.9 (fixed in 2.5.17)
remove-add-to-cart-woocommerce≤ 1.4.7

Show all 80

5starplugins4 products

dynamic copyright year≤ 1.0.4
easy_age_verify≤ 1.8.5
featured images in rss for mailchimp & more≤ 1.6.3
marijuana age verify≤ 1.5.5

Bplugins4 products

Fooplugins3 products

gallery by foogallery≤ 2.4.27
lightbox & modal popup wordpress plugin – foobox≤ 2.7.33
notification bar, announcement and cookie notice wordpress plugin – foobar≤ 2.1.34

Infornweb3 products

Josevega3 products

bulk edit posts and products in spreadsheet≤ 2.25.16
disable payment methods based on cart conditions for woocommerce≤ 1.16.3
wp page templates≤ 1.1.16

Mhmrajib3 products

Nicheaddons3 products

events_addon_for_elementor≤ 2.2.2
primary_addon_for_elementor≤ 1.6.0
restaurant_\&_cafe_addon_for_elementor≤ 1.5.8

Passionatebrains3 products

aeh speed optimization: browser cache, optimized minify, lazy loading & image optimization≤ 2.9.2
awca – the great analytics insights for your estore≤ 3.12.0
ga4wp – analytics dashboard for the website≤ 2.6.0

Princeahmed3 products

Fullworks2 products

anti-spam protection – no api key, gdpr friendly≤ 2.3.7
display eventbrite events≤ 6.1.10

Nitin2472 products

place order without payment for woocommerce≤ 2.6.5
thank you page for woocommerce≤ 4.2.0

Pagup2 products

Paretodigital2 products

embedder for google reviews≤ 1.6.6
send users email – email subscribers, email marketing newsletter≤ 1.5.10

Peterschulznl2 products

code manager≤ 1.0.40
wp data access – app builder for tables, forms, charts, maps & dashboards≤ 5.5.31

Premmerce2 products

premmerce permalink manager for woocommerce≤ 2.3.11
premmerce_product_filter_for_woocommerce≤ 3.7.3

Samdani2 products

Spiderdevs2 products

Takanakui2 products

menu image, icons made easy≤ 3.12
wp mobile menu – the mobile-friendly responsive menu≤ 2.8.6

Themelocation2 products

custom_woocommerce_checkout_fields_editor≤ 1.3.4
remove_add_to_cart_woocommerce≤ 1.4.7

100plugins1 product

open_user_map≤ 1.4.0

Afthemes1 product

wp post author – author box, multiple authors, guest authors & custom avatars≤ 3.8.3

Bensibley1 product

independent analytics≤ 2.9.7

Blackandwhitedigital1 product

treepress – easy family trees & ancestor profiles≤ 3.0.6

Blockspare1 product

blockspare — news, magazine and blog addons for (gutenberg) block editor≤ 3.2.6

Bouncingsprout1 product

ultimeter≤ 3.0.5

Cleverplugins1 product

security ninja – wordpress security & firewall≤ 5.222

Codesavory1 product

knowledge base documentation & wiki plugin – basepress docs≤ 2.16.3.3

Cyberhobo1 product

geo_mashup≤ 1.13.15

Cyclonecode1 product

custom php settings≤ 2.3.1

Damian-gora1 product

justified gallery≤ 1.9.0

Dashlabsltd1 product

yasr – yet another star rating plugin for wordpress≤ 3.4.12

Davidanderson1 product

internal link juicer: seo auto linker for wordpress≤ 2.24.6

Elespare1 product

elespare – news, magazine and blog addons for elementor≤ 3.3.2

Elliotvs1 product

coupon affiliates – affiliate plugin for woocommerce≤ 5.17.2

Enweby1 product

full screen background≤ 2.0.2

Essekia1 product

tablesome table – contact form db – wpforms, cf7, gravity, forminator, fluent≤ 1.1.13

Gallerycreator1 product

mixed media gallery blocks≤ 3.2.4.4

Gn_themes1 product

wp shortcodes plugin — shortcodes ultimate≤ 7.3.3

Gowebsmarty1 product

wp encryption – one click free ssl certificate & ssl / https redirect, security & ssl scan≤ 7.7.0

Hasanazizul1 product

text to speech tts accessibility≤ 1.7.34

Hkdigitalagency1 product

payment gateway for acba bank≤ 1.2.6

Imtiazrayhan1 product

wp coupons and deals – coupon plugin for affiliate marketers≤ 3.2.2

Inavii1 product

inavii social feed≤ 2.7.0

Infosatech1 product

revivepress – keep your old content evergreen≤ 1.5.8

Interactivegeomaps1 product

mapgeo – interactive geo maps≤ 1.6.22

Invisnet1 product

wp fail2ban – advanced security≤ 5.3.4

Kaira1 product

storecustomizer – a plugin to customize all woocommerce pages≤ 2.5.9

Kaizencoders1 product

url shortify – simple and easy url shortener≤ 1.10.4

Koen123441 product

post to google my business (google business profile)≤ 3.1.28

Kofimokome1 product

message_filter_for_contact_form_7≤ 1.6.3.2

Litonice131 product

master addons for elementor – widgets, extensions, theme builder, popup builder & template kits≤ 2.0.7.2

Mapster1 product

mapster_wp_maps≤ 1.9.0

Mattpramschufer1 product

pay for post with woocommerce≤ 3.1.26

Meowcrew1 product

role based pricing for woo by meow crew≤ 1.6.0

Mihail-barinov1 product

share this image≤ 2.07

Mikewire_rocksolid1 product

announcement & notification banner – bulletin≤ 3.12.1

Mohsinoffline1 product

secure gateway for authorize.net and woocommerce by pledged plugins≤ 6.1.13

Mr2p1 product

meta field block – display custom fields in the block editor without coding≤ 1.3.3

Mte901 product

glossary≤ 2.2.38

Oceanwp1 product

ocean extra≤ 2.4.2

Oxilab1 product

product layouts for woocommerce≤ 1.3.1

Pluginandplay1 product

post slider and post carousel with post vertical scrolling widget – a responsive post slider≤ 3.2.7

Plugins3601 product

automatic youtube gallery≤ 2.5.5

Pluginscafe1 product

smart phone field for gravity forms≤ 2.1.6

Pluginsware1 product

advanced classifieds & directory pro≤ 3.2.4

Prasadkirpekar1 product

wp_meta_and_date_remover≤ 2.3.4

Rebelcode1 product

spotlight social feeds – block, shortcode, and widget≤ 1.7.0

Saadiqbal1 product

post smtp – complete email deliverability and smtp solution with email logs, alerts, backup smtp & mobile app≤ 3.0.0

Sebet1 product

go fetch jobs (for wp job manager)≤ 1.8.4.8.1

Seezee1 product

five-star ratings shortcode≤ 1.2.56

Senols1 product

ai puffer – chat. create. automate. (formerly ai power)≤ 1.8.99

Sjaved1 product

easy social feed – social photos gallery and post feed for wordpress≤ 6.6.5

Smartwpress1 product

music player for elementor – audio player & podcast player≤ 2.4.1

Speedify1 product

auto-install free ssl – generate & install free ssl certificates≤ 4.5.0

Spicethemes1 product

carousel\,_recent_post_slider_and_banner_slider≤ 2.1

Streamweasels1 product

streamweasels twitch integration≤ 1.9.2

Theafricanboss1 product

checkout with cash app on woocommerce≤ 6.0.2

Tickera1 product

restrict – membership, site, content and user access restrictions for wordpress≤ 2.3.0

Tobias_conrad1 product

wow styler for cf7 – visual styler for contact form 7 forms≤ 1.7.0

Tobiasbg1 product

tablepress – tables in wordpress made easy≤ 3.0.2

Toddhalfpenny1 product

widgets on pages≤ 1.7

Tonyzeoli1 product

radio station by netmix® – manage and play your show schedule in wordpress!≤ 2.5.9

Tripetto1 product

wordpress form builder plugin for contact forms, surveys and quizzes – tripetto≤ 8.0.7

Unitecms1 product

unlimited elements for elementor≤ 1.5.140

Uriahs-victor1 product

kikote – location picker at checkout & google address autofill plugin for woocommerce≤ 1.10.6

Vinod-dalvi1 product

ivory search – wordpress search plugin≤ 5.5.8

Webba-agency1 product

easy appointment booking & scheduling system – webba booking calendar≤ 5.0.57

Webfactory1 product

ai bud – ai content generator, ai chatbot, chatgpt, gemini, gpt-4o≤ 1.7.2

Webheadllc1 product

contact form 7 multi-step forms≤ 4.4.1

Wordplus1 product

better messages – live chat, chat rooms, real-time messaging & private messages≤ 2.6.7

91 vendors · 200 products · Showing 200 of 263. Use Open JSON for the complete list.

References

25 links

Show all 25 references

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities