CVE-2026-82127
LowCVSS 3.5Summary
The Schema & Structured Data for WP & AMP WordPress plugin before version 1.67 does not perform a capability check when saving several of its fields, nor escape them when outputting them back, allowing users with the editor role and above to inject arbitrary web scripts that execute when a higher privileged user views the affected screen. This is only exploitable on multisite installs, where editors do not hold the unfiltered_html capability.
Risk Assessment
The risk includes the possibility of injecting malicious scripts that could execute in the context of an administrator, leading to account takeover or unauthorized changes to the site.
Recommendation
It is recommended to update the Schema & Structured Data for WP & AMP plugin to version 1.67 or later, which includes capability check and escaping fixes.
Other vulnerabilities in Schema & Structured Data for WP & AMP
See all- CVE-2026-9067Critical
The Schema & Structured Data for WP & AMP WordPress plugin before 1.60 does not check user capabilities on its frontend AJAX file-upload handlers and does not validate the actual content of uploaded files against the endpoint's intended media type, allowing unauthenticated users to upload any file type accepted by WordPress's media library through endpoints that should only accept images or videos.
- CVE-2026-97291High
The Schema & Structured Data for WP & AMP plugin version 1.66 and earlier contains a PHP Object Injection vulnerability that can be exploited by a user with Contributor role. The vulnerability allows injection of serialized PHP objects, potentially leading to arbitrary code execution or other unauthorized actions.
- CVE-2026-82126Low
The Schema & Structured Data for WP & AMP plugin before 1.66 fails to check user permissions to edit a specific post when generating schema, allowing users with contributor role and above to read other users' draft, pending, private and password-protected posts.
- CVE-2026-82125Medium
The plugin before 1.66 does not correctly verify comment ownership or moderation status before returning content, allowing unauthenticated users to read comments still awaiting moderation or marked as spam.
- CVE-2026-82124Medium
The plugin before 1.66 does not check if a post is password protected before including its content in structured data, allowing unauthenticated users to obtain password-protected post content through multiple public output routes.
Original NVD description (English source)
The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not perform a capability check when saving several of its fields, nor escape them when outputting them back, allowing users with the editor role and above to inject arbitrary web scripts that execute when a higher privileged user views the affected screen. This is only exploitable on multisite installs, where editors do not hold the unfiltered_html capability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS