Cross-Site Scripting Vulnerability in Schema App Structured Data plugin for WordPress

CVE-2024-11279

What is CVE-2024-11279?

The Schema App Structured Data plugin for WordPress contains a vulnerability that allows attackers to exploit reflected cross-site scripting (XSS). The issue arises from the inadequate escaping of URLs through the use of the add_query_arg function in versions up to and including 2.2.4. This vulnerability can be leveraged by unauthenticated attackers, who may successfully trick a user into clicking a malicious link, leading to the injection of arbitrary web scripts. As a result, an attacker can compromise the integrity of a user’s session or hijack sensitive information, posing serious risks to web security.

References