Stored Cross-Site Scripting in Structured Content Plugin for WordPress
CVE-2025-3414
Currently unrated
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 14 August 2025
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2025-3414?
The Structured Content (JSON-LD) plugin for WordPress prior to version 1.7.0 contains a security vulnerability that allows users with contributor privileges and higher to inject malicious scripts. This occurs because the plugin fails to properly validate and escape certain block options prior to rendering them in a page or post. As a result, attackers can exploit this flaw to carry out Stored Cross-Site Scripting (XSS) attacks, potentially compromising the security of WordPress sites and their users.
Affected Version(s)
Structured Content (JSON-LD) #wpsc 0 < 1.7.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.