Schema Structured Data For Wp Amp
Monthly
Stored cross-site scripting in the Schema & Structured Data for WP & AMP plugin (versions up to 1.67) allows unauthenticated attackers to inject arbitrary JavaScript via the 'saswp_review_text' parameter, because the nonce used as the sole authorization check is publicly exposed in the [saswp-reviews-form] shortcode. Exploitation requires the shortcode to be present, making it a genuine but deployment-specific issue that sits in the mid-tier of urgency. No public exploit code or active exploitation has been identified at time of analysis.
PHP object injection in the Schema & Structured Data for WP & AMP plugin (all versions up to and including 1.66) lets an authenticated attacker with a Contributor-level WordPress account feed crafted serialized input into a plugin deserialization path, and the vendor's CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 High) rates that as low-complexity, network-reachable and capable of full confidentiality, integrity and availability impact once a usable POP gadget chain is available in the plugin, WordPress core or another installed component. Authentication is mandatory and there is no unauthenticated route, but no user interaction is required after the attacker holds a qualifying account; the practical exposure therefore depends on whether the site permits open registration or loosely manages Contributor roles. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so the primary risk is post-authentication privilege escalation rather than opportunistic mass exploitation.
Unauthenticated arbitrary file upload in the Schema & Structured Data for WP & AMP WordPress plugin before version 1.60 allows remote attackers to upload any file type accepted by WordPress's media library through frontend AJAX handlers intended for images and videos only. The plugin fails to perform user capability checks and does not validate uploaded file content against the endpoint's declared media type. Publicly available exploit code exists via WPScan, increasing the urgency for immediate patching despite no confirmed in-the-wild exploitation.
Information disclosure in the Schema & Structured Data for WP & AMP WordPress plugin (versions 1.63 through 1.65) allows an authenticated user holding the WordPress contributor role or higher to retrieve the content of other users' draft, pending, private, and password-protected posts by invoking the plugin's schema-generation function against a post ID they are not permitted to edit. The root cause is a missing per-post edit-capability check, and impact is confidentiality-only - post content is exposed but cannot be modified. A public proof-of-concept is available, so exploitation is trivial for anyone with a contributor-level account on an affected site; EPSS is low at 0.17% (7th percentile) and there is no indication of confirmed active exploitation (not in CISA KEV).
Unauthenticated information disclosure in the Schema & Structured Data for WP & AMP WordPress plugin (versions 1.46 up to but not including 1.66) allows a remote attacker to read the body text of comments that are still pending moderation or have been flagged as spam. Exploitation requires no authentication, no user interaction, and no non-default configuration - only a vulnerable plugin version plus the existence of at least one unapproved comment on the target site - and publicly available exploit code exists, though there is no confirmed active exploitation (CISA KEV) and EPSS is low at 0.18% (8th percentile). Impact is confined to confidentiality of comment text: no credentials, write access, or administrative capability is exposed, which is consistent with the assessed CVSS 5.3 (C:L/I:N/A:N).
Unauthenticated visitors can read the body content of WordPress posts that authors marked as password protected when the Schema & Structured Data for WP & AMP plugin is installed at any version before 1.66. The plugin assembles its structured-data output without checking WordPress's post-password state, and it leaks the protected text through more than one public output route, so the only real precondition is that the site actually uses password-protected posts holding content worth hiding; sites that never set post passwords have nothing to expose. Publicly available exploit code exists (no CISA KEV entry), the vendor has released a fix in 1.66 per WPScan, and EPSS is low at 0.19% (9th percentile), making this a genuine but low-to-moderate severity information-disclosure issue rather than a high-urgency emergency.
The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'url' attribute within the Q&A Block widget in all versions up to, and. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom schema in all versions up to, and including, 1.26 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'saswp_reviews_form_render' function in all. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magazine3 Schema & Structured Data for WP & AMP allows Stored XSS.25. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Stored cross-site scripting in the Schema & Structured Data for WP & AMP plugin (versions up to 1.67) allows unauthenticated attackers to inject arbitrary JavaScript via the 'saswp_review_text' parameter, because the nonce used as the sole authorization check is publicly exposed in the [saswp-reviews-form] shortcode. Exploitation requires the shortcode to be present, making it a genuine but deployment-specific issue that sits in the mid-tier of urgency. No public exploit code or active exploitation has been identified at time of analysis.
PHP object injection in the Schema & Structured Data for WP & AMP plugin (all versions up to and including 1.66) lets an authenticated attacker with a Contributor-level WordPress account feed crafted serialized input into a plugin deserialization path, and the vendor's CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 High) rates that as low-complexity, network-reachable and capable of full confidentiality, integrity and availability impact once a usable POP gadget chain is available in the plugin, WordPress core or another installed component. Authentication is mandatory and there is no unauthenticated route, but no user interaction is required after the attacker holds a qualifying account; the practical exposure therefore depends on whether the site permits open registration or loosely manages Contributor roles. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so the primary risk is post-authentication privilege escalation rather than opportunistic mass exploitation.
Unauthenticated arbitrary file upload in the Schema & Structured Data for WP & AMP WordPress plugin before version 1.60 allows remote attackers to upload any file type accepted by WordPress's media library through frontend AJAX handlers intended for images and videos only. The plugin fails to perform user capability checks and does not validate uploaded file content against the endpoint's declared media type. Publicly available exploit code exists via WPScan, increasing the urgency for immediate patching despite no confirmed in-the-wild exploitation.
Information disclosure in the Schema & Structured Data for WP & AMP WordPress plugin (versions 1.63 through 1.65) allows an authenticated user holding the WordPress contributor role or higher to retrieve the content of other users' draft, pending, private, and password-protected posts by invoking the plugin's schema-generation function against a post ID they are not permitted to edit. The root cause is a missing per-post edit-capability check, and impact is confidentiality-only - post content is exposed but cannot be modified. A public proof-of-concept is available, so exploitation is trivial for anyone with a contributor-level account on an affected site; EPSS is low at 0.17% (7th percentile) and there is no indication of confirmed active exploitation (not in CISA KEV).
Unauthenticated information disclosure in the Schema & Structured Data for WP & AMP WordPress plugin (versions 1.46 up to but not including 1.66) allows a remote attacker to read the body text of comments that are still pending moderation or have been flagged as spam. Exploitation requires no authentication, no user interaction, and no non-default configuration - only a vulnerable plugin version plus the existence of at least one unapproved comment on the target site - and publicly available exploit code exists, though there is no confirmed active exploitation (CISA KEV) and EPSS is low at 0.18% (8th percentile). Impact is confined to confidentiality of comment text: no credentials, write access, or administrative capability is exposed, which is consistent with the assessed CVSS 5.3 (C:L/I:N/A:N).
Unauthenticated visitors can read the body content of WordPress posts that authors marked as password protected when the Schema & Structured Data for WP & AMP plugin is installed at any version before 1.66. The plugin assembles its structured-data output without checking WordPress's post-password state, and it leaks the protected text through more than one public output route, so the only real precondition is that the site actually uses password-protected posts holding content worth hiding; sites that never set post passwords have nothing to expose. Publicly available exploit code exists (no CISA KEV entry), the vendor has released a fix in 1.66 per WPScan, and EPSS is low at 0.19% (9th percentile), making this a genuine but low-to-moderate severity information-disclosure issue rather than a high-urgency emergency.
The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'url' attribute within the Q&A Block widget in all versions up to, and. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom schema in all versions up to, and including, 1.26 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'saswp_reviews_form_render' function in all. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magazine3 Schema & Structured Data for WP & AMP allows Stored XSS.25. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.