Stored Cross-Site Scripting in Schema & Structured Data for WP & AMP Plugin
CVE-2026-119035

Currently unrated

Key Information:

Vendor

WordPress
Status
Schema & Structured Data For WP & Amp
Vendor
CVE Published:
11 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-119035?

The Schema & Structured Data for WP & AMP WordPress plugin before version 1.70 is vulnerable to Stored Cross-Site Scripting (XSS) attacks. This vulnerability arises when the Pretty Print option is enabled, permitting users with the role of Contributor or higher to exploit the issue. As a result, these users can manipulate how structured data is outputted on the site, providing an opportunity for injecting malicious scripts through schema properties mapped to custom fields. This could lead to executing arbitrary JavaScript in the context of site visitors' browsers, posing a significant risk to user data and site integrity.

Affected Version(s)

Schema & Structured Data for WP & AMP 0 < 1.70

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-119035 - Proof of Concept

References

https://wpscan.com/vulnerability/f8fb358e-e0aa-4a4d-a4d0-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

vuxvinh
WPScan
.