WordPress Plugin Vulnerabilities

Schema & Structured Data for WP & AMP < 1.70 - Contributor+ Stored XSS via JSON-LD Pretty Print

Description

The plugin does not safely encode its structured data output when the Pretty Print option is enabled, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks when the site maps a schema property to a custom field.

Proof of Concept

Affects Plugins

Plugin icon
schema-and-structured-data-for-wp
Fixed in 1.70

References

CVE
CVE-2026-119035

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.4 (medium)

Miscellaneous

Original Researcher
vuxvinh
Submitter
vuxvinh
Verified
Yes
WPVDB ID
f8fb358e-e0aa-4a4d-a4d0-b6f383b115a2

Timeline

Publicly Published
2026-11-09 (about 2 days ago)
Added
2026-11-09 (about 1 day ago)
Last Updated
2026-11-09 (about 1 day ago)

Other

Published
Title
Published
2021-08-13
Title
Media Usage <= 0.0.4 - Reflected Cross-Site Scripting
Published
2025-02-21
Title
Kush Micro News <= 1.6.7 - Unauthenticated Stored Cross-Site Scripting
Published
2026-01-22
Title
Grand Magazine < 3.5.8 - Reflected Cross-Site Scripting
Published
2024-10-18
Title
Registrations for The Events Calendar < 2.12.4 - Unauthenticated Stored XSS
Published
2025-01-17
Title
JSM Screenshot Machine Shortcode < 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting