CVE-2024-11279: Schema App Structured Data <= 2.2.4 - Reflected Cross-Site Scripting
The Schema App Structured Data plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 2.2.4. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-11279?
CVE-2024-11279 is rated as High severity due to its potential to allow unauthenticated attackers to exploit the vulnerability.
How do I fix CVE-2024-11279?
To fix CVE-2024-11279, update the Schema App Structured Data plugin to version 2.2.5 or later.
Which versions of the Schema App Structured Data plugin are affected by CVE-2024-11279?
CVE-2024-11279 affects all versions of the Schema App Structured Data plugin up to and including version 2.2.4.
What kind of vulnerability is CVE-2024-11279?
CVE-2024-11279 is a Reflected Cross-Site Scripting (XSS) vulnerability.
Can CVE-2024-11279 be exploited remotely?
Yes, CVE-2024-11279 can be exploited remotely by unauthenticated attackers.