Stored Cross-Site Scripting Vulnerability in Schema App Structured Data Plugin for WordPress
CVE-2026-96666

7.2HIGH

Key Information:

Vendor

WordPress
Status
Schema App Structured Data
Vendor
CVE Published:
29 October 2026

What is CVE-2026-96666?

The Schema App Structured Data plugin for WordPress exhibits a Stored Cross-Site Scripting vulnerability primarily through the 'Remove Microdata' Output Filter. This flaw arises from improper input sanitization and output escaping, allowing unauthenticated users to inject arbitrary scripts into website pages. If an administrator activates the 'Remove Microdata' option and approves a malicious comment, the injected script will run whenever visitors access the compromised page, potentially exposing them to various security threats.

Affected Version(s)

Schema App Structured Data 0 <= 2.3.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/schema-app-str...
https://plugins.trac.wordpress.org/browser/schema-app-str...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

theviper17y
.