Schema And Structured Data For Wp Vulnerabilities

The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to arbitrary file uploads due to missing access control in all versions up to 1.60 (exclusive). This makes it possible for unauthenticated attackers to upload media files on the affected site's server.

CVSS:

5.3

Affected:

up to 1.60

Fixed in:

1.60

Disclosed:

Jun 11, 2026

CVE-2026-9067 on NVD →

[en] The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswp_custom_schema_field' profile field in all versions up to, and including, 1.54 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...

Affected:

up to 1.54.1

Fixed in:

1.54.1

Disclosed:

Jan 23, 2026

CVE-2025-14069 on NVD →

The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswp_custom_schema_field' profile field in all versions up to, and including, 1.54 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Co...

CVSS:

6.4

Affected:

up to 1.54

Fixed in:

1.54.1

Disclosed:

Jan 22, 2026

CVE-2025-14069 on NVD →

[en] The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'saswp_tiny_multiple_faq' shortcode in all versions up to, and including, 1.51 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

Affected:

up to 1.52

Fixed in:

1.52

Disclosed:

Nov 1, 2025

CVE-2025-11502 on NVD →

The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'saswp_tiny_multiple_faq' shortcode in all versions up to, and including, 1.51 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for a...

CVSS:

6.4

Affected:

up to 1.51

Fixed in:

1.52

Disclosed:

Oct 31, 2025

CVE-2025-11502 on NVD →

The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post comments in all versions up to, and including, 1.49 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag...

CVSS:

6.1

Affected:

up to 1.49

Fixed in:

1.50

Disclosed:

Sep 10, 2025

CVE-2025-9512 on NVD →

[en] Missing Authorization vulnerability in Schema & Structured Data for WP & AMP allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Schema & Structured Data for WP & AMP: from n/a through 1.3.5.

Affected:

up to 1.36

Fixed in:

1.36

Disclosed:

Oct 24, 2024

CVE-2024-49683 on NVD →

The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.35 via uploads stored in an unsafe directory. This makes it possible for unauthenticated attackers to extract potentially sensitive data from uploads.

CVSS:

5.3

Affected:

up to 1.35

Fixed in:

1.36

Disclosed:

Oct 21, 2024

CVE-2024-49683 on NVD →

[en] The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'url' attribute within the Q&A Block widget in all versions up to, and including, 1.33 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it p...

Affected:

up to 1.34.1

Fixed in:

1.34.1

Disclosed:

Jul 17, 2024

CVE-2024-5582 on NVD →

The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'url' attribute within the Q&A Block widget in all versions up to, and including, 1.33 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possib...

CVSS:

6.4

Affected:

up to 1.33

Fixed in:

1.34.1

Disclosed:

Jul 16, 2024

CVE-2024-5582 on NVD →

[en] The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's "How To" and "FAQ" Blocks in all versions up to, and including, 1.29 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authen...

Affected:

up to 1.30

Fixed in:

1.30

Disclosed:

Apr 23, 2024

CVE-2024-3491 on NVD →

The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's "How To" and "FAQ" Blocks in all versions up to, and including, 1.29 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat...

CVSS:

6.4

Affected:

up to 1.29

Fixed in:

1.30

Disclosed:

Apr 22, 2024

CVE-2024-3491 on NVD →

[en] The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'saswp_reviews_form_render' function in all versions up to, and including, 1.26. This makes it possible for authenticated attackers, with contributor access and...

Affected:

up to 1.27

Fixed in:

1.27

Disclosed:

Feb 20, 2024

CVE-2024-1288 on NVD →

[en] The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom schema in all versions up to, and including, 1.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts...

Affected:

up to 1.27

Fixed in:

1.27

Disclosed:

Feb 20, 2024

CVE-2024-1586 on NVD →

The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom schema in all versions up to, and including, 1.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in p...

CVSS:

6.4

Affected:

up to 1.26

Fixed in:

1.27

Disclosed:

Feb 19, 2024

CVE-2024-1586 on NVD →

The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'saswp_reviews_form_render' function in all versions up to, and including, 1.26. This makes it possible for authenticated attackers, with contributor access and abov...

CVSS:

4.3

Affected:

up to 1.26

Fixed in:

1.27

Disclosed:

Feb 19, 2024

CVE-2024-1288 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magazine3 Schema & Structured Data for WP & AMP allows Stored XSS.This issue affects Schema & Structured Data for WP & AMP: from n/a through 1.23.

Affected:

up to 1.24

Fixed in:

1.24

Disclosed:

Feb 1, 2024

CVE-2023-51677 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magazine3 Schema & Structured Data for WP & AMP allows Stored XSS.This issue affects Schema & Structured Data for WP & AMP: from n/a through 1.25.

Affected:

up to 1.26

Fixed in:

1.26

Disclosed:

Jan 31, 2024

CVE-2024-22146 on NVD →

The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.25 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers...

CVSS:

5.4

Affected:

up to 1.25

Fixed in:

1.26

Disclosed:

Jan 12, 2024

CVE-2024-22146 on NVD →

The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.25 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers...

Affected:

up to 1.26

Fixed in:

1.26

Disclosed:

Jan 12, 2024

The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary...

CVSS:

6.4

Affected:

up to 1.23

Fixed in:

1.24

Disclosed:

Dec 27, 2023

CVE-2023-51677 on NVD →

Affected:

up to 1.50

Fixed in:

1.50

CVE-2025-9512 on NVD →