Atomic Edge Proof of Concept automated generator using AI diff analysis
Published : May 4, 2026

CVE-2024-13362: Freemius <= 2.10.1 – Reflected DOM-Based Cross-Site Scripting via url Parameter (widget-for-eventbrite-api)

Severity Medium (CVSS 6.1)
CWE 79
Vulnerable Version 6.1.10
Patched Version 6.1.11
Disclosed April 29, 2026

Analysis Overview

Atomic Edge analysis of CVE-2024-13362:

This is a reflected DOM-based cross-site scripting vulnerability in the Freemius SDK library, affecting versions up to and including 2.10.1. The vulnerability stems from insufficient input sanitization of the ‘url’ parameter, allowing unauthenticated attackers to inject arbitrary JavaScript. The issue exists in the Freemius SDK bundled with plugins like Display Eventbrite Events (widget-for-eventbrite-api). The CVSS score is 6.1 (Medium).

The root cause lies in the Freemius SDK’s trial promotion notice handling within class-freemius.php. The vulnerable code at line 24000-24005 constructs an HTML anchor tag for a trial URL using sprintf() with the $trial_url variable. This variable ultimately comes from user-controllable parameters without proper escaping. The SDK directly injects the URL into an href attribute without validating or sanitizing the value. The patched version (2.11.0) restructures the notice to use a

wrapper with a button class and escapes the URL properly. The diff shows the change from ‘

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff
--- a/widget-for-eventbrite-api/build/blocks/display-eventbrite-events/index.asset.php
+++ b/widget-for-eventbrite-api/build/blocks/display-eventbrite-events/index.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('wp-block-editor', 'wp-blocks', 'wp-components', 'wp-element', 'wp-hooks', 'wp-i18n', 'wp-primitives', 'wp-server-side-render'), 'version' => '8dac7956f848ad544420');
+<?php return array('dependencies' => array('wp-block-editor', 'wp-blocks', 'wp-components', 'wp-element', 'wp-hooks', 'wp-i18n', 'wp-primitives', 'wp-server-side-render'), 'version' => '598cbcedba23a3be963d');
--- a/widget-for-eventbrite-api/includes/vendor/autoload.php
+++ b/widget-for-eventbrite-api/includes/vendor/autoload.php
@@ -22,4 +22,4 @@

 require_once __DIR__ . '/composer/autoload_real.php';

-return ComposerAutoloaderInit72aac7b444feed73f69908750fb12dfb::getLoader();
+return ComposerAutoloaderInit86434a5e50613c2822389a10fb579783::getLoader();
--- a/widget-for-eventbrite-api/includes/vendor/composer/autoload_files.php
+++ b/widget-for-eventbrite-api/includes/vendor/composer/autoload_files.php
@@ -7,5 +7,4 @@

 return array(
     'ce89ac35a6c330c55f4710717db9ff78' => $vendorDir . '/kriswallsmith/assetic/src/functions.php',
-    '8d50dc88e56bace65e1e72f6017983ed' => $vendorDir . '/freemius/wordpress-sdk/start.php',
 );
--- a/widget-for-eventbrite-api/includes/vendor/composer/autoload_real.php
+++ b/widget-for-eventbrite-api/includes/vendor/composer/autoload_real.php
@@ -2,7 +2,7 @@

 // autoload_real.php @generated by Composer

-class ComposerAutoloaderInit72aac7b444feed73f69908750fb12dfb
+class ComposerAutoloaderInit86434a5e50613c2822389a10fb579783
 {
     private static $loader;

@@ -24,16 +24,16 @@

         require __DIR__ . '/platform_check.php';

-        spl_autoload_register(array('ComposerAutoloaderInit72aac7b444feed73f69908750fb12dfb', 'loadClassLoader'), true, true);
+        spl_autoload_register(array('ComposerAutoloaderInit86434a5e50613c2822389a10fb579783', 'loadClassLoader'), true, true);
         self::$loader = $loader = new ComposerAutoloadClassLoader(dirname(__DIR__));
-        spl_autoload_unregister(array('ComposerAutoloaderInit72aac7b444feed73f69908750fb12dfb', 'loadClassLoader'));
+        spl_autoload_unregister(array('ComposerAutoloaderInit86434a5e50613c2822389a10fb579783', 'loadClassLoader'));

         require __DIR__ . '/autoload_static.php';
-        call_user_func(ComposerAutoloadComposerStaticInit72aac7b444feed73f69908750fb12dfb::getInitializer($loader));
+        call_user_func(ComposerAutoloadComposerStaticInit86434a5e50613c2822389a10fb579783::getInitializer($loader));

         $loader->register(true);

-        $filesToLoad = ComposerAutoloadComposerStaticInit72aac7b444feed73f69908750fb12dfb::$files;
+        $filesToLoad = ComposerAutoloadComposerStaticInit86434a5e50613c2822389a10fb579783::$files;
         $requireFile = Closure::bind(static function ($fileIdentifier, $file) {
             if (empty($GLOBALS['__composer_autoload_files'][$fileIdentifier])) {
                 $GLOBALS['__composer_autoload_files'][$fileIdentifier] = true;
--- a/widget-for-eventbrite-api/includes/vendor/composer/autoload_static.php
+++ b/widget-for-eventbrite-api/includes/vendor/composer/autoload_static.php
@@ -4,11 +4,10 @@

 namespace ComposerAutoload;

-class ComposerStaticInit72aac7b444feed73f69908750fb12dfb
+class ComposerStaticInit86434a5e50613c2822389a10fb579783
 {
     public static $files = array (
         'ce89ac35a6c330c55f4710717db9ff78' => __DIR__ . '/..' . '/kriswallsmith/assetic/src/functions.php',
-        '8d50dc88e56bace65e1e72f6017983ed' => __DIR__ . '/..' . '/freemius/wordpress-sdk/start.php',
     );

     public static $prefixLengthsPsr4 = array (
@@ -74,10 +73,10 @@
     public static function getInitializer(ClassLoader $loader)
     {
         return Closure::bind(function () use ($loader) {
-            $loader->prefixLengthsPsr4 = ComposerStaticInit72aac7b444feed73f69908750fb12dfb::$prefixLengthsPsr4;
-            $loader->prefixDirsPsr4 = ComposerStaticInit72aac7b444feed73f69908750fb12dfb::$prefixDirsPsr4;
-            $loader->prefixesPsr0 = ComposerStaticInit72aac7b444feed73f69908750fb12dfb::$prefixesPsr0;
-            $loader->classMap = ComposerStaticInit72aac7b444feed73f69908750fb12dfb::$classMap;
+            $loader->prefixLengthsPsr4 = ComposerStaticInit86434a5e50613c2822389a10fb579783::$prefixLengthsPsr4;
+            $loader->prefixDirsPsr4 = ComposerStaticInit86434a5e50613c2822389a10fb579783::$prefixDirsPsr4;
+            $loader->prefixesPsr0 = ComposerStaticInit86434a5e50613c2822389a10fb579783::$prefixesPsr0;
+            $loader->classMap = ComposerStaticInit86434a5e50613c2822389a10fb579783::$classMap;

         }, null, ClassLoader::class);
     }
--- a/widget-for-eventbrite-api/includes/vendor/composer/installed.php
+++ b/widget-for-eventbrite-api/includes/vendor/composer/installed.php
@@ -3,7 +3,7 @@
         'name' => 'fullworks/widget-for-eventbrite-api',
         'pretty_version' => 'dev-master',
         'version' => 'dev-master',
-        'reference' => '61eed9ad8c1d3d481181740eef706277f8d595da',
+        'reference' => '186922f9385d4f8b15ed9c4c8a1278de976f9a5a',
         'type' => 'wordpress-plugin',
         'install_path' => __DIR__ . '/../../../',
         'aliases' => array(),
@@ -40,9 +40,9 @@
             'dev_requirement' => false,
         ),
         'freemius/wordpress-sdk' => array(
-            'pretty_version' => '2.10.1',
-            'version' => '2.10.1.0',
-            'reference' => '5f57de9d7504b37b0ee9f5da44b6699c99854dd2',
+            'pretty_version' => '2.11.0',
+            'version' => '2.11.0.0',
+            'reference' => null,
             'type' => 'library',
             'install_path' => __DIR__ . '/../freemius/wordpress-sdk',
             'aliases' => array(),
@@ -60,7 +60,7 @@
         'fullworks/widget-for-eventbrite-api' => array(
             'pretty_version' => 'dev-master',
             'version' => 'dev-master',
-            'reference' => '61eed9ad8c1d3d481181740eef706277f8d595da',
+            'reference' => '186922f9385d4f8b15ed9c4c8a1278de976f9a5a',
             'type' => 'wordpress-plugin',
             'install_path' => __DIR__ . '/../../../',
             'aliases' => array(),
@@ -121,9 +121,9 @@
             'dev_requirement' => false,
         ),
         'woocommerce/action-scheduler' => array(
-            'pretty_version' => '3.9.0',
-            'version' => '3.9.0.0',
-            'reference' => '90b98e6fe97d455679b1d288f050cad8f6f79771',
+            'pretty_version' => '3.9.1',
+            'version' => '3.9.1.0',
+            'reference' => 'd73b5f83cd42832fa137e03687bad3e312298d29',
             'type' => 'wordpress-plugin',
             'install_path' => __DIR__ . '/../woocommerce/action-scheduler',
             'aliases' => array(),
--- a/widget-for-eventbrite-api/includes/vendor/freemius/wordpress-sdk/includes/class-freemius.php
+++ b/widget-for-eventbrite-api/includes/vendor/freemius/wordpress-sdk/includes/class-freemius.php
@@ -24000,13 +24000,15 @@

             // Start trial button.
             $button = ' ' . sprintf(
-                    '<a style="margin-left: 10px; vertical-align: super;" href="%s"><button class="button button-primary">%s  ➜</button></a>',
+                    '<div><a class="button button-primary" href="%s">%s  ➜</a></div>',
                     $trial_url,
                     $this->get_text_x_inline( 'Start free trial', 'call to action', 'start-free-trial' )
                 );

+            $message_text = $this->apply_filters( 'trial_promotion_message', "{$message} {$cc_string}" );
+
             $this->_admin_notices->add_sticky(
-                $this->apply_filters( 'trial_promotion_message', "{$message} {$cc_string} {$button}" ),
+                "<div class="fs-trial-message-container"><div>{$message_text}</div> {$button}</div>",
                 'trial_promotion',
                 '',
                 'promotion'
@@ -25476,7 +25478,7 @@
                 $img_dir = WP_FS__DIR_IMG;

                 // Locate the main assets folder.
-                if ( 1 < count( $fs_active_plugins->plugins ) ) {
+                if ( ! empty( $fs_active_plugins->plugins ) ) {
                     $plugin_or_theme_img_dir = ( $this->is_plugin() ? WP_PLUGIN_DIR : get_theme_root( get_stylesheet() ) );

                     foreach ( $fs_active_plugins->plugins as $sdk_path => &$data ) {
--- a/widget-for-eventbrite-api/includes/vendor/freemius/wordpress-sdk/includes/class-fs-plugin-updater.php
+++ b/widget-for-eventbrite-api/includes/vendor/freemius/wordpress-sdk/includes/class-fs-plugin-updater.php
@@ -542,24 +542,8 @@

             global $wp_current_filter;

-            $current_plugin_version = $this->_fs->get_plugin_version();
-
-            if ( ! empty( $wp_current_filter ) && 'upgrader_process_complete' === $wp_current_filter[0] ) {
-                if (
-                    is_null( $this->_update_details ) ||
-                    ( is_object( $this->_update_details ) && $this->_update_details->new_version !== $current_plugin_version )
-                ) {
-                    /**
-                     * After an update, clear the stored update details and reparse the plugin's main file in order to get
-                     * the updated version's information and prevent the previous update information from showing up on the
-                     * updates page.
-                     *
-                     * @author Leo Fajardo (@leorw)
-                     * @since 2.3.1
-                     */
-                    $this->_update_details  = null;
-                    $current_plugin_version = $this->_fs->get_plugin_version( true );
-                }
+            if ( ! empty( $wp_current_filter ) && in_array( 'upgrader_process_complete', $wp_current_filter ) ) {
+                return $transient_data;
             }

             if ( ! isset( $this->_update_details ) ) {
@@ -568,7 +552,7 @@
                     false,
                     fs_request_get_bool( 'force-check' ),
                     FS_Plugin_Updater::UPDATES_CHECK_CACHE_EXPIRATION,
-                    $current_plugin_version
+                    $this->_fs->get_plugin_version()
                 );

                 $this->_update_details = false;
--- a/widget-for-eventbrite-api/includes/vendor/freemius/wordpress-sdk/includes/entities/class-fs-plugin-plan.php
+++ b/widget-for-eventbrite-api/includes/vendor/freemius/wordpress-sdk/includes/entities/class-fs-plugin-plan.php
@@ -13,7 +13,6 @@
 	/**
 	 * Class FS_Plugin_Plan
 	 *
-	 * @property FS_Pricing[] $pricing
 	 */
 	class FS_Plugin_Plan extends FS_Entity {

--- a/widget-for-eventbrite-api/includes/vendor/freemius/wordpress-sdk/includes/entities/class-fs-site.php
+++ b/widget-for-eventbrite-api/includes/vendor/freemius/wordpress-sdk/includes/entities/class-fs-site.php
@@ -10,16 +10,16 @@
         exit;
     }

-    /**
-     * @property int $blog_id
-     */
-    #[AllowDynamicProperties]
     class FS_Site extends FS_Scope_Entity {
         /**
          * @var number
          */
         public $site_id;
         /**
+         * @var int
+         */
+        public $blog_id;
+        /**
          * @var number
          */
         public $plugin_id;
--- a/widget-for-eventbrite-api/includes/vendor/freemius/wordpress-sdk/includes/entities/class-fs-user.php
+++ b/widget-for-eventbrite-api/includes/vendor/freemius/wordpress-sdk/includes/entities/class-fs-user.php
@@ -48,6 +48,19 @@
 			parent::__construct( $user );
 		}

+		/**
+		 * This method removes the deprecated 'is_beta' property from the serialized data.
+		 * Should clean up the serialized data to avoid PHP 8.2 warning on next execution.
+		 *
+		 * @return void
+		 */
+		function __wakeup() {
+			if ( property_exists( $this, 'is_beta' ) ) {
+				// If we enter here, and we are running PHP 8.2, we already had the warning. But we sanitize data for next execution.
+				unset( $this->is_beta );
+			}
+		}
+
 		function get_name() {
 			return trim( ucfirst( trim( is_string( $this->first ) ? $this->first : '' ) ) . ' ' . ucfirst( trim( is_string( $this->last ) ? $this->last : '' ) ) );
 		}
--- a/widget-for-eventbrite-api/includes/vendor/freemius/wordpress-sdk/includes/managers/class-fs-admin-menu-manager.php
+++ b/widget-for-eventbrite-api/includes/vendor/freemius/wordpress-sdk/includes/managers/class-fs-admin-menu-manager.php
@@ -699,16 +699,36 @@
 				$menu = $this->find_main_submenu();
 			}

+			$menu_slug   = $menu['menu'][2];
 			$parent_slug = isset( $menu['parent_slug'] ) ?
-                $menu['parent_slug'] :
-                'admin.php';
+				$menu['parent_slug'] :
+				'admin.php';

-            return admin_url(
-                $parent_slug .
-                ( false === strpos( $parent_slug, '?' ) ? '?' : '&' ) .
-                'page=' .
-                $menu['menu'][2]
-            );
+			if ( fs_apply_filter( $this->_module_unique_affix, 'enable_cpt_advanced_menu_logic', false ) ) {
+				$parent_slug = 'admin.php';
+
+				/**
+				 * This line and the `if` block below it are based on the `menu_page_url()` function of WordPress.
+				 *
+				 * @author Leo Fajardo (@leorw)
+				 * @since 2.10.2
+				 */
+				global $_parent_pages;
+
+				if ( ! empty( $_parent_pages[ $menu_slug ] ) ) {
+					$_parent_slug = $_parent_pages[ $menu_slug ];
+					$parent_slug  = isset( $_parent_pages[ $_parent_slug ] ) ?
+						$parent_slug :
+						$menu['parent_slug'];
+				}
+			}
+
+			return admin_url(
+				$parent_slug .
+				( false === strpos( $parent_slug, '?' ) ? '?' : '&' ) .
+				'page=' .
+				$menu_slug
+			);
 		}

 		/**
--- a/widget-for-eventbrite-api/includes/vendor/freemius/wordpress-sdk/includes/managers/class-fs-admin-notice-manager.php
+++ b/widget-for-eventbrite-api/includes/vendor/freemius/wordpress-sdk/includes/managers/class-fs-admin-notice-manager.php
@@ -194,8 +194,14 @@
          * @since  1.0.7
          */
         static function _add_sticky_dismiss_javascript() {
+            $sticky_admin_notice_js_template_name = 'sticky-admin-notice-js.php';
+
+            if ( ! file_exists( fs_get_template_path( $sticky_admin_notice_js_template_name ) ) ) {
+                return;
+            }
+
             $params = array();
-            fs_require_once_template( 'sticky-admin-notice-js.php', $params );
+            fs_require_once_template( $sticky_admin_notice_js_template_name, $params );
         }

         private static $_added_sticky_javascript = false;
--- a/widget-for-eventbrite-api/includes/vendor/freemius/wordpress-sdk/start.php
+++ b/widget-for-eventbrite-api/includes/vendor/freemius/wordpress-sdk/start.php
@@ -15,7 +15,7 @@
 	 *
 	 * @var string
 	 */
-	$this_sdk_version = '2.10.1';
+	$this_sdk_version = '2.11.0';

 	#region SDK Selection Logic --------------------------------------------------------------------

--- a/widget-for-eventbrite-api/widget-for-eventbrite-api.php
+++ b/widget-for-eventbrite-api/widget-for-eventbrite-api.php
@@ -6,7 +6,7 @@
  * Plugin Name:       Display Eventbrite Events
  * Plugin URI:        https://fullworksplugins.com/products/widget-for-eventbrite/
  * Description:       Easily display Eventbrite events on your WordPress site
- * Version:           6.1.10
+ * Version:           6.1.11
  * Requires at least: 5.6
  * Requires PHP:      7.4
  * Author:            Fullworks
@@ -41,7 +41,7 @@
 define( 'WIDGET_FOR_EVENTBRITE_API_PLUGIN_NAME', basename( WIDGET_FOR_EVENTBRITE_API_PLUGIN_DIR ) );
 define( 'WIDGET_FOR_EVENTBRITE_API_PLUGIN_URL', plugin_dir_url( __FILE__ ) );
 define( 'WIDGET_FOR_EVENTBRITE_API_PLUGINS_TOP_DIR', plugin_dir_path( __DIR__ ) );
-define( 'WIDGET_FOR_EVENTBRITE_API_PLUGIN_VERSION', '6.1.10' );
+define( 'WIDGET_FOR_EVENTBRITE_API_PLUGIN_VERSION', '6.1.11' );
 // Include the plugin autoloader, so we can dynamically include the classes.
 require_once WIDGET_FOR_EVENTBRITE_API_PLUGIN_DIR . 'includes/vendor/autoload.php';
 new AutoloaderPlugin(__NAMESPACE__, __DIR__);

ModSecurity Protection Against This CVE

Frequently Asked Questions

Trusted by Developers & Organizations

Trusted by Developers
Blac&kMcDonaldCovenant House TorontoAlzheimer Society CanadaUniversity of TorontoHarvard Medical School