Atomic Edge analysis of CVE-2024-13362 (metadata-based): This is a reflected DOM-based cross-site scripting (XSS) vulnerability found in multiple WordPress plugins and themes that use the Freemius SDK library, specifically version 2.10.1 and earlier. The flaw exists in the handling of the ‘url’ parameter, allowing unauthenticated attackers to inject arbitrary web scripts. The CVSS score is 6.1 (Medium), with a vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating network-based exploitation with low complexity and no privileges required, but requiring user interaction.
The root cause, inferred from the CWE (79) and the vulnerability description, is insufficient input sanitization and output escaping of the ‘url’ parameter within the Freemius SDK. The SDK likely takes a ‘url’ parameter and uses it to construct a redirect or load external content (common in Freemius for authentication or license activation flows). Without proper escaping, this parameter is inserted into the DOM via JavaScript. Since it is DOM-based, the attack payload executes in the browser context without being reflected in the HTML source code, making it detectable only via DOM analysis. This conclusion is inferred from the vulnerability type and common Freemius SDK patterns; no code diff was available for confirmation.
Exploitation requires tricking a user into clicking a crafted link. The attack vector is typically through the Freemius SDK’s JavaScript handler that processes the ‘url’ parameter, often found in the plugin’s admin pages or frontend authentication flows. An attacker would craft a malicious URL such as: https://target-site.com/wp-admin/admin.php?page=plugin-settings&url=javascript:alert(document.cookie). When a logged-in administrator clicks this link, the JavaScript executes in their browser. The lack of nonce verification or capability checks in the SDK’s handling of this parameter makes it accessible to unauthenticated attackers.
Remediation requires sanitizing the ‘url’ parameter using WordPress functions like esc_url_raw() for URL validation and wp_kses() for HTML context escaping. The fix should be applied in the Freemius SDK version 2.10.2, which processes the ‘url’ parameter. Plugin developers should update to the latest Freemius SDK version. For virtual patching, the WAF rule should target the specific URL patterns where the Freemius SDK processes the ‘url’ parameter, blocking requests with ‘javascript:’ or ‘data:’ URI schemes.
If exploited, this vulnerability allows an attacker to execute arbitrary JavaScript in the context of the victim’s browser session. This can lead to session hijacking, cookie theft, ake of admin actions, or redirection to malicious sites. Since the attack is reflected and requires user interaction, the impact is limited to actions the victim can perform, but an administrator victim could expose full site control. The scope is changed (S:C) because the attack can affect resources beyond the vulnerable application.
