Cross-Site Scripting Vulnerability in Schema App Structured Data plugin for WordPress
CVE-2024-11279

6.1MEDIUM

Key Information:

Vendor
Wordpress
Status
Schema App Structured Data
Vendor
CVE Published:
12 December 2024

Summary

The Schema App Structured Data plugin for WordPress contains a vulnerability that allows attackers to exploit reflected cross-site scripting (XSS). The issue arises from the inadequate escaping of URLs through the use of the add_query_arg function in versions up to and including 2.2.4. This vulnerability can be leveraged by unauthenticated attackers, who may successfully trick a user into clicking a malicious link, leading to the injection of arbitrary web scripts. As a result, an attacker can compromise the integrity of a user’s session or hijack sensitive information, posing serious risks to web security.

Affected Version(s)

Schema App Structured Data * <= 2.2.4

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://wordpress.org/plugins/schema-app-structured-data-...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Peter Thaleikis
.