CVE-2024-11359 is a reflected Cross-Site Scripting vulnerability in the photonicgnostic Library Bookshelves WordPress plugin. The issue arises from the use of add_query_arg without proper escaping of URL parameters, enabling injection of arbitrary web scripts. This affects all versions up to and including 5.8. An attacker can exploit this by tricking users into clicking malicious links, leading to script execution in the context of the vulnerable site. The vulnerability has a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of the affected website, potentially leading to limited confidentiality and integrity impacts. This could result in actions such as session hijacking or defacement if users are tricked into clicking malicious links. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the plugin or restricting access to affected pages. Additionally, applying web application firewall (WAF) rules to detect and block reflected XSS attempts may help mitigate risk. Avoid clicking on suspicious links related to the affected site.