All vulnerabilities
CVE-2026-82127

Schema & Structured Data for WP & AMP < 1.67 - Editor+ Stored XSS via Taxonomy Term Fields

Unknown Schema & Structured Data for WP & AMP
Open in ThreatlineRecord JSON
CVSS
3.5Low
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.14%Chance of exploitation activity in the next 30 days, higher than 3% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.67Fixed versionCVE List
Published30 Sep 2026Updated 30 Sep 2026CVE List

What fixes it

  • 1.67Schema & Structured Data for WP & AMPCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not perform a capability check when saving several of its fields, nor escape them when outputting them back, allowing users with the editor role and above to inject arbitrary web scripts that execute when a higher privileged user views the affected screen. This is only exploitable on multisite installs, where editors do not hold the unfiltered_html capability.

Text from CVE List

Affected versions 1

  • Schema & Structured Data for WP & AMPaffected: all versions before 1.67CVE List

References 1