Schema & Structured Data for WP & AMP < 1.27 - Authenticated Stored XSS

Description

The plugin is vulnerable to Stored Cross-Site Scripting via the custom schema due to insufficient input sanitization and output escaping, allowing authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default the required authentication level is admin, but administrators have the ability to assign role based access to users as low as subscriber.