Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 42,685 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · schema-and-structured-data-for-wp
Schema & Structured Data for WP & AMP
17 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 16, 2026Schema & Structured Data for WP & AMP: Stored Cross-Site ScriptingCVE-2026-96570 · affects up to 1.67 · reported by WordfenceHigh 7.2
The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswp_review_text' parameter in all versions up to, and including, 1.67 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce that serves as the only authorization gate is publicly printed in the [saswp-reviews-form] shortcode HTML, making it obtainable by any anonymous visitor and rendering it ineffective as an access control boundary.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 30, 2026Contributor PHP Object Injection in Schema & Structured Data for WP & AMP <= 1.66 versions.CVE-2026-97291 · affects up to 1.66 · reported by PatchstackHigh 8.8
Contributor PHP Object Injection in Schema & Structured Data for WP & AMP <= 1.66 versions.
Sep 30, 2026Schema & Structured Data for WP & AMP: Does not perform a capability checkCVE-2026-82127 · fixed in 1.67 · reported by WPScanLow 3.5
The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not perform a capability check when saving several of its fields, nor escape them when outputting them back, allowing users with the editor role and above to inject arbitrary web scripts that execute when a higher privileged user views the affected screen. This is only exploitable on multisite installs, where editors do not hold the unfiltered_html capability.
Sep 16, 2026Schema & Structured Data for WP & AMP: Does not check that a user is allowed to edit the specific post they request schema generation forCVE-2026-82126 · fixed in 1.66 · reported by WPScanLow 2.7
The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check that a user is allowed to edit the specific post they request schema generation for, allowing users with the contributor role and above to obtain the content of other users' draft, pending, private and password protected posts.
Sep 16, 2026Schema & Structured Data for WP & AMP: Does not correctly verify the ownership or the moderation status of a comment before returning its contentCVE-2026-82125 · fixed in 1.66 · reported by WPScanMedium 5.3
The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not correctly verify the ownership or the moderation status of a comment before returning its content, allowing unauthenticated users to read the content of comments still awaiting moderation or marked as spam.
Sep 16, 2026Schema & Structured Data for WP & AMP: Does not check whether a post is password protected before including its content in the structured data it generatesCVE-2026-82124 · fixed in 1.66 · reported by WPScanMedium 5.3
The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check whether a post is password protected before including its content in the structured data it generates, allowing unauthenticated users to obtain the content of password protected posts via more than one public output route.
Jun 10, 2026Schema & Structured Data for WP & AMP: Does not check user capabilities on its frontend AJAX file-upload handlers and does not validate the actual content of uploaded files against the endpoint's intended media typeCVE-2026-9067 · fixed in 1.60 · reported by WPScanCritical 9.1
The Schema & Structured Data for WP & AMP WordPress plugin before 1.60 does not check user capabilities on its frontend AJAX file-upload handlers and does not validate the actual content of uploaded files against the endpoint's intended media type, allowing unauthenticated users to upload any file type accepted by WordPress's media library through endpoints that should only accept images or videos.
Jan 23, 2026Schema & Structured Data for WP & AMP: Stored Cross-Site ScriptingCVE-2025-14069 · affects up to 1.54 · reported by WordfenceMedium 6.4
The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswp_custom_schema_field' profile field in all versions up to, and including, 1.54 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 1, 2025Schema & Structured Data for WP & AMP: Stored Cross-Site ScriptingCVE-2025-11502 · affects up to 1.51 · reported by WordfenceMedium 6.4
The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'saswp_tiny_multiple_faq' shortcode in all versions up to, and including, 1.51 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 1, 2025Schema & Structured Data for WP & AMP: Does not properly handles HTML tag attribute modificationsCVE-2025-9512 · fixed in 1.50 · reported by WPScanMedium 6.1
The Schema & Structured Data for WP & AMP WordPress plugin before 1.50 does not properly handles HTML tag attribute modifications, making it possible for unauthenticated attackers to conduct Stored XSS attacks via post comments.
Oct 24, 2024Schema & Structured Data for WP & AMP: Missing AuthorizationCVE-2024-49683 · affects up to 1.3.5 · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Magazine3 Schema & Structured Data for WP & AMP schema-and-structured-data-for-wp allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Schema & Structured Data for WP & AMP: from n/a through <= 1.3.5.
Jul 17, 2024Schema & Structured Data for WP & AMP: Stored Cross-Site ScriptingCVE-2024-5582 · affects up to 1.33 · reported by WordfenceMedium 6.4
The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'url' attribute within the Q&A Block widget in all versions up to, and including, 1.33 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 23, 2024Schema & Structured Data for WP & AMP: Stored Cross-Site ScriptingCVE-2024-3491 · affects up to 1.29 · reported by WordfenceMedium 6.4
The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's "How To" and "FAQ" Blocks in all versions up to, and including, 1.29 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Feb 28, 2024Schema & Structured Data for WP & AMP: Stored Cross-Site ScriptingCVE-2024-1586 · affects up to 1.26 · reported by WordfenceMedium 6.4
The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom schema in all versions up to, and including, 1.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default the required authentication level is admin, but administrators have the ability to assign role based access to users as low as subscriber.
Feb 28, 2024Schema & Structured Data for WP & AMP: Unauthorized modification of dataCVE-2024-1288 · affects up to 1.26 · reported by WordfenceMedium 4.3
The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'saswp_reviews_form_render' function in all versions up to, and including, 1.26. This makes it possible for authenticated attackers, with contributor access and above, to modify the plugin's stored reCaptcha site and secret keys, potentially breaking the reCaptcha functionality.
NVD recordplugins.svn.wordpress.orgplugins.trac.wordpress.org
Feb 1, 2024Schema & Structured Data for WP & AMP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51677 · affects up to 1.23 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magazine3 Schema & Structured Data for WP & AMP allows Stored XSS.This issue affects Schema & Structured Data for WP & AMP: from n/a through 1.23.
Jan 31, 2024Schema & Structured Data for WP & AMP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-22146 · affects up to 1.25 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magazine3 Schema & Structured Data for WP & AMP allows Stored XSS.This issue affects Schema & Structured Data for WP & AMP: from n/a through 1.25.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.