What is the CVSS score of CVE-2026-3604?

CVE-2026-3604 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WP SEO Structured Data Schema CVE-2026-3604

EUVD-2026-29391 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-12 Wordfence

GHSA-vfvr-pxr9-rgwp

XSS WordPress

4.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 08:46 vuln.today

CVE Published

May 12, 2026 - 07:48 nvd

MEDIUM 4.9

DescriptionCVE.org

The WP SEO Structured Data Schema plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the _kcseo_ative_tab parameter in all versions up to, and including, 2.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting (XSS) in WP SEO Structured Data Schema plugin for WordPress versions up to 2.8.1 allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript via the _kcseo_ative_tab parameter, which executes in the browsers of users viewing affected pages. The vulnerability stems from insufficient input sanitization and output escaping in the plugin's metadata handling. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

The vulnerability exists in the KcSeoMetaData class (lines 133 and 177 in the affected versions) where the _kcseo_ative_tab parameter is processed without proper sanitization or escaping before being output to the page. This is a classic Stored XSS vulnerability (CWE-79) where user-controlled input is saved to the database and later rendered in HTML context without sanitization. The plugin is distributed via the WordPress plugin repository and affects all installations using versions 2.8.1 and earlier. The affected CPE identifier is cpe:2.3:a:kcseopro:wp_seo_structured_data_schema:*:*:*:*:*:*:*:*, indicating the vulnerability impacts all versions of the plugin.

RemediationAI

Update the WP SEO Structured Data Schema plugin to a patched version released after 2.8.1 (patch version confirmation pending from vendor/repository). Implement this update immediately through the WordPress plugin dashboard or via direct upload of the patched version. As a temporary compensating control pending patch availability, restrict Contributor-level access to only trusted users and regularly audit user roles and capabilities within WordPress; however, this does not eliminate the vulnerability, only reduces exposure. Additionally, implement Content Security Policy (CSP) headers configured to restrict inline script execution (script-src) to mitigate potential XSS impact if exploitation occurs. Monitor the WordPress plugin repository and Wordfence advisories for patch release confirmation.