CVE-2026-119032

The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not check that the importing user may edit the posts named in a settings backup, nor restrict the import to its own post types, allowing users whose role an administrator has granted access to the Schema & Structured Data...

CVE-2026-119034

The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not verify that a post is publicly viewable before returning its approved comments through the review feature, allowing unauthenticated attackers to read approved comments on private, draft and password-protected posts, a...

CVE-2026-119033

The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not verify that a user may edit a post before letting them change that post's structured data settings, allowing users with the Contributor role and above, when an administrator has granted them access to the Schema &...

CVE-2026-119035

The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not safely encode its structured data output when the Pretty Print option is enabled, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks when the site maps a schema property to...

CVE-2026-119035 Schema & Structured Data for WP & AMP < 1.70 - Contributor+ Stored XSS via JSON-LD Pretty Print

The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not safely encode its structured data output when the Pretty Print option is enabled, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks when the site maps a schema property to...

EUVD-2026-123180

The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not safely encode its structured data output when the Pretty Print option is enabled, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks when the site maps a schema property to...

CVE-2026-119033

The Schema & Structured Data for WP & AMP WordPress plugin versions prior to 1.70 is vulnerable to an Insecure Direct Object Reference (IDOR) . The root cause is a failure to verify whether a user has permission to edit a specific post before allowing changes to its structured data settings. Cons...

WordPress Schema & Structured Data for WP & AMP plugin < 1.70 - Contributor+ Structured Data Modification of Other Users' Posts vulnerability

Contributor+ Structured Data Modification of Other Users' Posts vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Schema & Structured Data for WP & AMP versions 1.70...

CVE-2026-119035

The Schema & Structured Data for WP & AMP WordPress plugin versions prior to 1.70 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the plugin's failure to safely encode structured data output when the Pretty Print option is enabled. Specifically, this occurs when a site maps...

CVE-2026-119032

The Schema & Structured Data for WP & AMP WordPress plugin, in versions before 1.70 , is vulnerable to Authenticated Arbitrary Post Modification . The root cause is a failure to verify if an importing user has permission to edit posts specified in a settings backup , coupled with a lack of restri...

WordPress Schema & Structured Data for WP & AMP plugin < 1.70 - Authenticated Arbitrary Post Modification vulnerability

Authenticated Arbitrary Post Modification vulnerability discovered by Raphael P. Cigana in WordPress Plugin Schema & Structured Data for WP & AMP versions 1.70...

WordPress Schema & Structured Data for WP & AMP plugin < 1.70 - Unauthenticated Non-Public Comment Disclosure vulnerability

Unauthenticated Non-Public Comment Disclosure vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Schema & Structured Data for WP & AMP versions 1.70...

WordPress Schema & Structured Data for WP & AMP plugin < 1.70 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by vuxvinh in WordPress Plugin Schema & Structured Data for WP & AMP versions 1.70...

CVE-2026-119032 Schema & Structured Data for WP & AMP < 1.70 - Authenticated Arbitrary Post Modification via Backup Import

The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not check that the importing user may edit the posts named in a settings backup, nor restrict the import to its own post types, allowing users whose role an administrator has granted access to the Schema & Structured Data...

EUVD-2026-123177

The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not check that the importing user may edit the posts named in a settings backup, nor restrict the import to its own post types, allowing users whose role an administrator has granted access to the Schema & Structured Data...

EUVD-2026-123178

The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not verify that a user may edit a post before letting them change that post's structured data settings, allowing users with the Contributor role and above, when an administrator has granted them access to the Schema &...

EUVD-2026-123179

The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not verify that a post is publicly viewable before returning its approved comments through the review feature, allowing unauthenticated attackers to read approved comments on private, draft and password-protected posts, a...

CVE-2026-119033 Schema & Structured Data for WP & AMP < 1.70 - Contributor+ Structured Data Modification of Other Users' Posts via IDOR

The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not verify that a user may edit a post before letting them change that post's structured data settings, allowing users with the Contributor role and above, when an administrator has granted them access to the Schema &...

CVE-2026-119034

The Schema & Structured Data for WP & AMP WordPress plugin (versions before 1.70 ) contains a vulnerability where it fails to verify if a post is publicly viewable before returning approved comments via the review feature. This flaw allows unauthenticated attackers to read approved comments on pr...

CVE-2026-119034 Schema & Structured Data for WP & AMP < 1.70 - Unauthenticated Non-Public Comment Disclosure via Review Filter

The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not verify that a post is publicly viewable before returning its approved comments through the review feature, allowing unauthenticated attackers to read approved comments on private, draft and password-protected posts, a...