Stored Cross-Site Scripting Vulnerability in Structured Content Plugin for WordPress
CVE-2025-0512
5.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 4 March 2025
What is CVE-2025-0512?
The Structured Content (JSON-LD) plugin for WordPress is vulnerable to a Stored Cross-Site Scripting attack through the sc_fs_local_business shortcode due to inadequate input sanitization and output escaping. Authenticated users with contributor-level access or higher can exploit this vulnerability to insert arbitrary scripts in WordPress pages. When such a page is viewed by an unsuspecting user, the injected scripts execute in their browser context, potentially leading to unauthorized actions and data exposure.
Affected Version(s)
Structured Content (JSON-LD) #wpsc * <= 1.6.3