CVE-2026-119035: falha de média gravidade em Schema & Structured Data for WP & AMP
Schema & Structured Data for WP & AMP < 1.70 - Contributor+ Stored XSS via JSON-LD Pretty Print
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
10Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.4
The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not safely encode its structured data output when the Pretty Print option is enabled, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks when the site maps a schema property to a custom field.
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
Unknown · Schema & Structured Data for WP & AMPCVEs relacionadas — Schema & Structured Data for WP & AMP
No mesmo produto, das mais perigosas para as menos.
CVE-2026-9067CRITICALSchema & Structured Data for WP & AMP < 1.60 - Unauthenticated Arbitrary Media UploadEPSS 0.6%CVE-2026-82124MEDIUMSchema & Structured Data for WP & AMP < 1.66 - Unauthenticated Password-Protected Post Content Disclosure via JSON-LD Schema OutputEPSS 0.3%CVE-2026-82125MEDIUMSchema & Structured Data for WP & AMP 1.46 - 1.65 - Unauthenticated Non-Public Comment Content Disclosure via IDOREPSS 0.3%CVE-2026-82126LOWSchema & Structured Data for WP & AMP 1.63 - 1.65 - Contributor+ Non-Public Post Content Disclosure via AI Schema GenerationEPSS 0.3%CVE-2025-9512MEDIUMSchema & Structured Data for WP & AMP < 1.50 - Unauthenticated Stored-XSSEPSS 0.3%CVE-2026-82127LOWSchema & Structured Data for WP & AMP < 1.67 - Editor+ Stored XSS via Taxonomy Term FieldsEPSS 0.1%