Schema Structured Data EUVD-2026-102657

Exploitation requires that a page on the target site render the [saswp-reviews-form] shortcode from the Schema & Structured Data for WP & AMP plugin, since that shortcode both exposes the submission form and publicly prints the nonce used as the sole authorization gate. Given that precondition, no authentication, privileges, or user interaction are needed by the attacker to inject the payload via the 'saswp_review_text' parameter (CVSS PR:N/UI:N). The main limiting factor is deployment-specific: sites that do not use the reviews form/shortcode, or that have the reviews module disabled, do not expose the vulnerable submission path. Execution of the stored payload occurs passively when any user subsequently views the injected page.

This is a genuine, exploitable issue rather than a paper-tiger high-CVSS finding, but it sits in the mid-tier of urgency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C) describes a network-reachable, low-complexity, unauthenticated flaw with a changed scope, and the description corroborates each metric: the only authorization gate (a nonce) is printed directly in the public [saswp-reviews-form] shortcode HTML, so any anonymous visitor can harvest it, which legitimately justifies PR:N. The scope change (S:C) and the fact that injected script executes in the browser of any later visitor explain why impact is rated C:L/I:L despite stored XSS normally needing a victim to load the page. Countervailing signals temper the priority: no EPSS probability was supplied, there is no CISA KEV listing, and no public proof-of-concept is referenced - only a Wordfence vulnerability record and WordPress.org trac source links. There is no evidence of active exploitation; treat this as a patch-soon web application flaw, not an emergency. One point to verify with the vendor: the description states 'all versions up to, and including, 1.67,' yet every source/trac reference points at tag 1.66, so the exact first-fixed version should be confirmed against the Magazine3 changelog.

An anonymous attacker loads a page containing the [saswp-reviews-form] shortcode, reads the authorization nonce printed in that page's HTML, and submits a review whose 'saswp_review_text' field contains a malicious script payload. Because the input is stored without sufficient sanitization and rendered without output escaping, the script later executes in the browser of every visitor (including logged-in administrators) who views the affected page, enabling session/cookie theft or admin-context actions. No public exploit code is referenced, but the attack is simple enough to reproduce from the description alone.