EUVD-2026-14169
GHSA-c6fv-mp3f-p6j3
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The Schema Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's itemscope shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
The Schema Shortcode plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the itemscope shortcode that allows authenticated attackers with contributor-level access or higher to inject arbitrary malicious scripts into pages. These injected scripts execute whenever any user accesses the affected page, potentially compromising visitor sessions and data. With a CVSS score of 6.4 and confirmed vulnerability through Wordfence intelligence, this represents a meaningful risk to WordPress sites using this plugin, though exploitation requires authenticated access rather than unauthenticated exploitation.
Technical ContextAI
The vulnerability exists in the Schema Shortcode plugin (identified via CPE cpe:2.3:a:jeric_izon:schema_shortcode:*:*:*:*:*:*:*:*) and stems from insufficient input sanitization and output escaping of user-supplied attributes within the itemscope shortcode handler, as evidenced by code inspection at the plugin's repository line 41. This is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation, commonly known as Cross-site Scripting). The root cause is that WordPress shortcode attributes are processed without proper sanitization before being rendered in the HTML output, allowing attackers to bypass WordPress's security filters and inject executable JavaScript that runs in the context of authenticated user sessions.
RemediationAI
The primary remediation is to deactivate and remove the Schema Shortcode plugin immediately, as no patched version has been identified in available intelligence. Site administrators should check for any pages or posts using the vulnerable itemscope shortcode and migrate to an alternative schema markup solution (such as Yoast SEO, RankMath, or direct JSON-LD implementation). Until the plugin can be removed, restrict contributor-level and higher permissions to only trusted administrators and regularly audit user roles and permissions. Additionally, implement a Web Application Firewall (WAF) rule to detect and block injection attempts targeting shortcode attributes, and review page/post revision history to identify any injected malicious scripts already present. For ongoing protection, monitor the WordPress plugin repository and Wordfence advisories (https://www.wordfence.com/threat-intel/vulnerabilities/id/b8c89d80-0ae5-4849-b739-0881fec188bf) for patch availability or official plugin discontinuation notices.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today