Magazine3 Schema & Structured Data for WP & AMP vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Magazine3 Schema & Structured Data for WP & AMP: 4 record(s), with affected versions and fixes.
CVE-2026-96570
High · 7.2
CWE-79 Oct 16, 2026
Schema & Structured Data for WP & AMP <= 1.67 - Unauthenticated Stored Cross-Site Scripting via 'saswp_review_text' Parameter
The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswp_review_text' parameter in all versions up to, and including, 1.67 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce that serves as the only authorization gate is publicly printed in the [saswp-reviews-form] shortcode HTML, making it obtainable by any anonymous visitor and rendering it ineffective as an access control boundary.
CVE-2026-97291
High · 8.8
CWE-502 Sep 30, 2026
WordPress Schema & Structured Data for WP & AMP plugin <= 1.66 - PHP Object Injection vulnerability
Contributor PHP Object Injection in Schema & Structured Data for WP & AMP <= 1.66 versions.
CVE-2025-14069
Medium · 6.4
CWE-79 Jan 23, 2026
Schema & Structured Data for WP & AMP <= 1.54 - Authenticated (Contributor+) Stored Cross-Site Scripting via User Custom Schema
The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswp_custom_schema_field' profile field in all versions up to, and including, 1.54 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2025-11502
Medium · 6.4
CWE-79 Nov 1, 2025
Schema & Structured Data for WP & AMP <= 1.51 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'saswp_tiny_multiple_faq' shortcode in all versions up to, and including, 1.51 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.