CVE-2026-97291

Contributor PHP Object Injection in Schema & Structured Data for WP & AMP = 1.66 versions...

CVE-2026-97291 WordPress Schema & Structured Data for WP & AMP plugin <= 1.66 - PHP Object Injection vulnerability

Contributor PHP Object Injection in Schema & Structured Data for WP & AMP = 1.66 versions...

CVE-2026-97291 WordPress Schema & Structured Data for WP & AMP plugin <= 1.66 - PHP Object Injection vulnerability

Contributor PHP Object Injection in Schema & Structured Data for WP & AMP = 1.66 versions...

EUVD-2026-90218

Contributor PHP Object Injection in Schema & Structured Data for WP & AMP = 1.66 versions...

CVE-2026-97291

The Schema & Structured Data for WP & AMP plugin for WordPress, versions

CVE-2026-82127

The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not perform a capability check when saving several of its fields, nor escape them when outputting them back, allowing users with the editor role and above to inject arbitrary web scripts that execute when a higher...

CVE-2026-82127 Schema & Structured Data for WP & AMP < 1.67 - Editor+ Stored XSS via Taxonomy Term Fields

The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not perform a capability check when saving several of its fields, nor escape them when outputting them back, allowing users with the editor role and above to inject arbitrary web scripts that execute when a higher...

CVE-2026-82127 Schema & Structured Data for WP & AMP < 1.67 - Editor+ Stored XSS via Taxonomy Term Fields

The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not perform a capability check when saving several of its fields, nor escape them when outputting them back, allowing users with the editor role and above to inject arbitrary web scripts that execute when a higher...

CVE-2026-82127

The Schema & Structured Data for WP & AMP WordPress plugin (versions before 1.67 ) is vulnerable to a stored cross-site scripting (XSS) flaw. The vulnerability exists because the plugin fails to perform proper capability checks when saving specific fields and lacks sufficient output escaping . Th...

EUVD-2026-89635

The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not perform a capability check when saving several of its fields, nor escape them when outputting them back, allowing users with the editor role and above to inject arbitrary web scripts that execute when a higher...

WordPress Schema & Structured Data for WP & AMP plugin < 1.67 - Editor+ Stored XSS vulnerability

Editor+ Stored XSS vulnerability discovered by Thomas Valadez in WordPress Plugin Schema & Structured Data for WP & AMP versions 1.67...

WordPress AMP for WP – Accelerated Mobile Pages plugin <= 1.1.16 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Pham Duc Anh in WordPress Plugin AMP for WP versions = 1.1.16...

CVE-2026-83591

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Regex Transformation in all versions up to, and including, 1.1.16 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-83591 AMP for WP <= 1.1.16 - Unauthenticated Stored Cross-Site Scripting via Comment Content Regex Transformation

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Regex Transformation in all versions up to, and including, 1.1.16 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-83591

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.1.16 . The root cause is insufficient input sanitization and output escaping during a Regex Transformation of comment content. Specifically, the ...

CVE-2026-83591 AMP for WP <= 1.1.16 - Unauthenticated Stored Cross-Site Scripting via Comment Content Regex Transformation

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Regex Transformation in all versions up to, and including, 1.1.16 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-86535

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Regex Transformation in all versions up to, and including, 1.1.16 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-54521: Improper Neutralization of Input During Web Page Generation

FairEmail is a fully featured, open source, privacy-friendly email app for Android. Prior to 1.2319, the ActivityAMP AMP message renderer in app/src/main/java/eu/faircode/email/ActivityAMP.java enables JavaScript in its WebView but incompletely sanitizes untrusted message HTML. For non-allowliste...

WordPress Schema & Structured Data for WP & AMP plugin 1.63-1.65 - Contributor+ Non-Public Post Content Disclosure vulnerability

Contributor+ Non-Public Post Content Disclosure vulnerability discovered by Shirshak in WordPress Plugin Schema & Structured Data for WP & AMP versions 1.63-1.65...

WordPress Schema & Structured Data for WP & AMP plugin 1.46-1.65 - Unauthenticated Non-Public Comment Content Disclosure vulnerability

Unauthenticated Non-Public Comment Content Disclosure vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Schema & Structured Data for WP & AMP versions 1.46-1.65...