Structured Content Vulnerabilities

The Structured Content (JSON-LD) #wpsc plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary we...

CVSS:

6.4

Affected:

up to 1.7.0

Fix:

No patched version reported

Disclosed:

Jul 2, 2026

CVE-2026-57763 on NVD →

The Structured Content (JSON-LD) #wpsc plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the FAQ block in all versions up to, and including, 1.6.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...

CVSS:

6.4

Affected:

up to 1.6.4

Fixed in:

1.7.0

Disclosed:

Jul 24, 2025

CVE-2025-3414 on NVD →

The Structured Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sc_fs_local_business shortcode in all versions up to, and including, 1.6.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,...

CVSS:

6.4

Affected:

up to 1.6.4

Fixed in:

1.7.0

Disclosed:

Jul 23, 2025

CVE-2025-4608 on NVD →

The Structured Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pag...

CVSS:

6.4

Affected:

up to 1.6.3

Fixed in:

1.6.4

Disclosed:

Mar 27, 2025

CVE-2025-30918 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codemacher Structured Content allows Stored XSS. This issue affects Structured Content: from n/a through 1.6.3.

Affected:

up to 1.6.4

Fixed in:

1.6.4

Disclosed:

Mar 27, 2025

CVE-2025-30918 on NVD →

The Structured Content (JSON-LD) #wpsc plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sc_fs_local_business shortcode in all versions up to, and including, 6.4.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenti...

CVSS:

6.4

Affected:

up to 1.6.3

Fixed in:

1.6.4

Disclosed:

Mar 3, 2025

CVE-2025-0512 on NVD →

[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gordon Böhme, Antonio Leutsch Structured Content allows Stored XSS.This issue affects Structured Content: from n/a through 1.6.2.

Affected:

up to 1.6.3

Fixed in:

1.6.3

Disclosed:

Aug 18, 2024

CVE-2024-43307 on NVD →

The Structured Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pag...

CVSS:

6.4

Affected:

up to 1.6.2

Fixed in:

1.6.3

Disclosed:

Aug 16, 2024

CVE-2024-43307 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gordon Böhme, Antonio Leutsch Structured Content (JSON-LD) #wpsc allows Stored XSS.This issue affects Structured Content (JSON-LD) #wpsc: from n/a through 1.6.1.

Affected:

up to 1.6.2

Fixed in:

1.6.2

Disclosed:

Feb 5, 2024

CVE-2024-24839 on NVD →

The Structured Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Classic Editor shortcodes in all versions up to, and including, 1.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access an...

CVSS:

6.4

Affected:

up to 1.6.1

Fixed in:

1.6.2

Disclosed:

Feb 2, 2024

CVE-2024-24839 on NVD →

[en] Deserialization of Untrusted Data vulnerability in Gordon Böhme, Antonio Leutsch Structured Content (JSON-LD) #wpsc.This issue affects Structured Content (JSON-LD) #wpsc: from n/a through 1.5.3.

Affected:

up to 1.6.0

Fixed in:

1.6.0

Disclosed:

Dec 18, 2023

CVE-2023-49819 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gordon Böhme, Antonio Leutsch Structured Content (JSON-LD) #wpsc allows Stored XSS.This issue affects Structured Content (JSON-LD) #wpsc: from n/a through 1.5.3.

Affected:

up to 1.6.0

Fixed in:

1.6.0

Disclosed:

Dec 14, 2023

CVE-2023-49820 on NVD →

The Structured Content (JSON-LD) #wpsc plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.5.3 via deserialization of untrusted input. This makes it possible for attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in th...

CVSS:

8.8

Affected:

up to 1.5.3

Fixed in:

1.6.0

Disclosed:

Dec 5, 2023

CVE-2023-49819 on NVD →

The Structured Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pag...

CVSS:

6.4

Affected:

up to 1.5.3

Fixed in:

1.6.0

Disclosed:

Dec 5, 2023

CVE-2023-49820 on NVD →

[en] The Structured Content WordPress plugin before 1.5.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such...

Affected:

up to 1.5.1

Fixed in:

1.5.1

Disclosed:

Jan 23, 2023

CVE-2022-4715 on NVD →

The Structured Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor level a...

CVSS:

6.4

Affected:

up to 1.5.0

Fixed in:

1.5.1

Disclosed:

Dec 28, 2022

CVE-2022-4715 on NVD →

Affected:

up to 1.6.4

Fixed in:

1.6.4

CVE-2025-0512 on NVD →

Affected:

up to 1.6.4

Fix:

No patched version reported

CVE-2025-4608 on NVD →