CVE-2026-96570

The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswpreviewtext' parameter in all versions up to, and including, 1.67 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...

EUVD-2026-102657

The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswpreviewtext' parameter in all versions up to, and including, 1.67 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...

CVE-2026-96570 Schema & Structured Data for WP & AMP <= 1.67 - Unauthenticated Stored Cross-Site Scripting via 'saswp_review_text' Parameter

The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswpreviewtext' parameter in all versions up to, and including, 1.67 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...

CVE-2026-96570

The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.67 . The root cause is insufficient input sanitization and output escaping of the saswp_review_text parameter. This allows unauthenticated attack...

WordPress Schema & Structured Data for WP & AMP plugin <= 1.67 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by r3foxx in WordPress Plugin Schema & Structured Data for WP & AMP versions = 1.67...

CVE-2026-97291

Contributor PHP Object Injection in Schema & Structured Data for WP & AMP = 1.66 versions...

CVE-2026-97291

The Schema & Structured Data for WP & AMP plugin for WordPress, versions

EUVD-2026-90218

Contributor PHP Object Injection in Schema & Structured Data for WP & AMP = 1.66 versions...

CVE-2026-97291 WordPress Schema & Structured Data for WP & AMP plugin <= 1.66 - PHP Object Injection vulnerability

Contributor PHP Object Injection in Schema & Structured Data for WP & AMP = 1.66 versions...

CVE-2026-97291 WordPress Schema & Structured Data for WP & AMP plugin <= 1.66 - PHP Object Injection vulnerability

Contributor PHP Object Injection in Schema & Structured Data for WP & AMP = 1.66 versions...

WordPress Schema & Structured Data for WP & AMP plugin <= 1.66 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Schema & Structured Data for WP & AMP versions = 1.66...

CVE-2026-82127

The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not perform a capability check when saving several of its fields, nor escape them when outputting them back, allowing users with the editor role and above to inject arbitrary web scripts that execute when a higher...

CVE-2026-82127 Schema & Structured Data for WP & AMP < 1.67 - Editor+ Stored XSS via Taxonomy Term Fields

The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not perform a capability check when saving several of its fields, nor escape them when outputting them back, allowing users with the editor role and above to inject arbitrary web scripts that execute when a higher...

EUVD-2026-89635

The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not perform a capability check when saving several of its fields, nor escape them when outputting them back, allowing users with the editor role and above to inject arbitrary web scripts that execute when a higher...

CVE-2026-82127

The Schema & Structured Data for WP & AMP WordPress plugin (versions before 1.67 ) is vulnerable to a stored cross-site scripting (XSS) flaw. The vulnerability exists because the plugin fails to perform proper capability checks when saving specific fields and lacks sufficient output escaping . Th...

CVE-2026-82127 Schema & Structured Data for WP & AMP < 1.67 - Editor+ Stored XSS via Taxonomy Term Fields

The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not perform a capability check when saving several of its fields, nor escape them when outputting them back, allowing users with the editor role and above to inject arbitrary web scripts that execute when a higher...

WordPress Schema & Structured Data for WP & AMP plugin < 1.67 - Editor+ Stored XSS vulnerability

Editor+ Stored XSS vulnerability discovered by Thomas Valadez in WordPress Plugin Schema & Structured Data for WP & AMP versions 1.67...

PT-2026-103507

Contributor PHP Object Injection in Schema & Structured Data for WP & AMP = 1.66 versions...

CVE-2026-97291: Deserialization of Untrusted Data

Contributor PHP Object Injection in Schema & Structured Data for WP & AMP = 1.66 versions...

PT-2026-103026

The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not perform a capability check when saving several of its fields, nor escape them when outputting them back, allowing users with the editor role and above to inject arbitrary web scripts that execute when a higher...