CVE-2026-82126lowCWE-284

CVE-2026-82126: fallo de gravedad baja en Schema & Structured Data for WP & AMP

Schema & Structured Data for WP & AMP 1.63 - 1.65 - Contributor+ Non-Public Post Content Disclosure via AI Schema Generation

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Schema & Structured Data for WP & AMP

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 2.7epss 0.3%
The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check that a user is allowed to edit the specific post they request schema generation for, allowing users with the contributor role and above to obtain the content of other users' draft, pending, private and password protected posts.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Productos afectados
Unknown · Schema & Structured Data for WP & AMP
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Schema & Structured Data for WP & AMP

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-9067CRITICALSchema & Structured Data for WP & AMP < 1.60 - Unauthenticated Arbitrary Media UploadEPSS 0.6%CVE-2026-82124MEDIUMSchema & Structured Data for WP & AMP < 1.66 - Unauthenticated Password-Protected Post Content Disclosure via JSON-LD Schema OutputEPSS 0.3%CVE-2026-82125MEDIUMSchema & Structured Data for WP & AMP 1.46 - 1.65 - Unauthenticated Non-Public Comment Content Disclosure via IDOREPSS 0.3%CVE-2025-9512MEDIUMSchema & Structured Data for WP & AMP < 1.50 - Unauthenticated Stored-XSSEPSS 0.3%CVE-2026-82127LOWSchema & Structured Data for WP & AMP < 1.67 - Editor+ Stored XSS via Taxonomy Term FieldsEPSS 0.1%CVE-2026-119035MEDIUMSchema & Structured Data for WP & AMP < 1.70 - Contributor+ Stored XSS via JSON-LD Pretty PrintEPSS —