Schema & Structured Data EUVD-2026-89635

Exploitation requires ALL of the following: (1) a WordPress MULTISITE installation - the flaw is explicitly not exploitable on single-site installs because editors there hold the unfiltered_html capability; (2) an attacker account with the editor role or above on the target site; and (3) user interaction from a higher-privileged victim (e.g., an administrator) who must view the affected admin screen where the unescaped schema/structured-data fields are rendered. These three conditions - non-default multisite deployment, authenticated privileged attacker, and required victim interaction - collectively make widespread or automated exploitation impractical.

This is a low-real-risk, high-precondition stored XSS despite being network-vectored. All signals align toward low priority: SSVC states Exploitation 'none', Automatable 'no', and Technical Impact 'partial'; there is no EPSS score provided, no CISA KEV listing, and no public POC - so exploitation status is 'no public exploit identified at time of analysis'. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N = 3.5 Low) reflects the two strong limiters baked into the description: the attacker must already hold an editor-or-above account (PR:H) AND a higher-privileged victim must view the affected admin screen (UI:R). Critically, the flaw is ONLY exploitable on WordPress multisite installs, because on single-site installs editors retain the unfiltered_html capability and can legitimately post HTML anyway - this narrows the real-world attack surface substantially. The one nuance worth flagging: the vendor kept S:U, but a stored XSS injected by an editor that fires in a higher-privileged administrator's browser session arguably crosses a security/authority boundary and could justify S:C - this raises the theoretical score but does not change the operational conclusion. No signals are missing that would elevate urgency; this is a genuine but low-priority issue best handled via routine patching.

On a WordPress multisite install running the plugin below 1.67, a user with the editor role edits schema/structured-data fields (which lack a capability check and are output unescaped), storing a malicious JavaScript payload. When an administrator later opens the affected settings/edit screen, the script executes in the admin's authenticated session, enabling actions such as creating a new admin account or altering site settings. No public exploit code was identified at time of analysis.