CVE-2024-11279 describes a reflected XSS vulnerability in the Schema App Structured Data WordPress plugin caused by the use of add_query_arg without proper escaping of URL parameters. This flaw exists in all versions up to and including 2.2.4. An attacker can exploit this by crafting a malicious URL that injects arbitrary JavaScript, which executes when a user clicks the link. The vulnerability requires no privileges but does require user interaction. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the victim's browser session, potentially leading to information disclosure or manipulation of the user interface. The vulnerability does not impact availability and has low impact on confidentiality and integrity. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with links and consider disabling or removing the plugin if possible. Monitoring vendor channels for updates is recommended.