Is Schema & Structured Data for WP & AMP safe?

Every recorded flaw

• Oct 16, 2026Schema & Structured Data for WP & AMP: Stored Cross-Site ScriptingCVE-2026-96570 · affects up to 1.67 · reported by WordfenceHigh 7.2
• Sep 30, 2026Contributor PHP Object Injection in Schema & Structured Data for WP & AMP <= 1.66 versions.CVE-2026-97291 · affects up to 1.66 · reported by PatchstackHigh 8.8
• Sep 30, 2026Schema & Structured Data for WP & AMP: Does not perform a capability checkCVE-2026-82127 · fixed in 1.67 · reported by WPScanLow 3.5
• Sep 16, 2026Schema & Structured Data for WP & AMP: Does not check that a user is allowed to edit the specific post they request schema generation forCVE-2026-82126 · fixed in 1.66 · reported by WPScanLow 2.7
• Sep 16, 2026Schema & Structured Data for WP & AMP: Does not correctly verify the ownership or the moderation status of a comment before returning its contentCVE-2026-82125 · fixed in 1.66 · reported by WPScanMedium 5.3
• Sep 16, 2026Schema & Structured Data for WP & AMP: Does not check whether a post is password protected before including its content in the structured data it generatesCVE-2026-82124 · fixed in 1.66 · reported by WPScanMedium 5.3
• Jun 10, 2026Schema & Structured Data for WP & AMP: Does not check user capabilities on its frontend AJAX file-upload handlers and does not validate the actual content of uploaded files against the endpoint's intended media typeCVE-2026-9067 · fixed in 1.60 · reported by WPScanCritical 9.1
• Jan 23, 2026Schema & Structured Data for WP & AMP: Stored Cross-Site ScriptingCVE-2025-14069 · affects up to 1.54 · reported by WordfenceMedium 6.4
• Nov 1, 2025Schema & Structured Data for WP & AMP: Stored Cross-Site ScriptingCVE-2025-11502 · affects up to 1.51 · reported by WordfenceMedium 6.4
• Oct 1, 2025Schema & Structured Data for WP & AMP: Does not properly handles HTML tag attribute modificationsCVE-2025-9512 · fixed in 1.50 · reported by WPScanMedium 6.1
• Oct 24, 2024Schema & Structured Data for WP & AMP: Missing AuthorizationCVE-2024-49683 · affects up to 1.3.5 · reported by PatchstackMedium 5.3
• Jul 17, 2024Schema & Structured Data for WP & AMP: Stored Cross-Site ScriptingCVE-2024-5582 · affects up to 1.33 · reported by WordfenceMedium 6.4
• Apr 23, 2024Schema & Structured Data for WP & AMP: Stored Cross-Site ScriptingCVE-2024-3491 · affects up to 1.29 · reported by WordfenceMedium 6.4
• Feb 28, 2024Schema & Structured Data for WP & AMP: Stored Cross-Site ScriptingCVE-2024-1586 · affects up to 1.26 · reported by WordfenceMedium 6.4
• Feb 28, 2024Schema & Structured Data for WP & AMP: Unauthorized modification of dataCVE-2024-1288 · affects up to 1.26 · reported by WordfenceMedium 4.3
• Feb 1, 2024Schema & Structured Data for WP & AMP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2023-51677 · affects up to 1.23 · reported by PatchstackMedium 6.5
• Jan 31, 2024Schema & Structured Data for WP & AMP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-22146 · affects up to 1.25 · reported by PatchstackMedium 6.5

Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.