CVE-2024-11363 describes a reflected cross-site scripting vulnerability in the Same but Different – Related Posts by Taxonomy plugin for WordPress. The issue arises from the plugin's use of add_query_arg and remove_query_arg functions without proper escaping of URL parameters, enabling injection of malicious scripts. This affects all versions up to and including 1.0.16. An attacker can exploit this by crafting a URL that, when visited by a user, executes arbitrary JavaScript in the context of the victim's browser session.

Successful exploitation can lead to execution of attacker-controlled scripts in the context of the victim's browser, potentially resulting in theft of sensitive information or session tokens (confidentiality impact) and unauthorized modification of displayed content (integrity impact). There is no direct impact on system availability. The vulnerability requires user interaction (clicking a malicious link) and no privileges are needed to exploit it.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid clicking suspicious links related to this plugin. Monitoring for updates from outtheboxthemes is recommended to apply any forthcoming patches. No official patch or workaround information is currently provided.