Cross-Site Scripting Vulnerability in Schema & Structured Data Plugin for WordPress
CVE-2026-82127
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 30 September 2026
Badges
What is CVE-2026-82127?
The Schema & Structured Data for WP & AMP plugin for WordPress prior to version 1.67 is susceptible to a cross-site scripting vulnerability. The issue lies in the lack of capability checks during the saving of specific fields, alongside insufficient escaping when displaying these fields. This oversight allows users with the editor role and above to inject arbitrary web scripts. The vulnerability poses a risk primarily in multisite installations, where editors lack the unfiltered_html capability, enabling potential XSS attacks when a higher-privileged user accesses the compromised screen.
Affected Version(s)
Schema & Structured Data for WP & AMP 0 < 1.67
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.