Schema & Structured Data for WP & AMP
schema-and-structured-data-for-wp · plugin
Known security vulnerabilities for Schema & Structured Data for WP & AMP. Find out in seconds which version runs on your site with WP Lens.
8 known vulnerabilities
1 exploitable without logging in · latest Sep 30, 2026
Listed on wordpress.org · latest 1.67 · last updated Sep 24, 2026 · 100K+ installs
wordpress.org status checked on Oct 2, 2026
Vulnerabilities
- High 8.8
CVE-2026-97291contributor+≤ 1.66
WordPress Schema & Structured Data for WP & AMP plugin <= 1.66 - PHP Object Injection vulnerability
- Medium 6.4
CVE-2025-14069contributor+≤ 1.54
Schema & Structured Data for WP & AMP <= 1.54 - Authenticated (Contributor+) Stored Cross-Site Scripting via User Custom Schema
- Medium 6.4
CVE-2025-11502contributor+≤ 1.51
Schema & Structured Data for WP & AMP <= 1.51 - Authenticated (Contributor+) Stored Cross-Site Scripting
- Medium 6.4
CVE-2024-3491contributor+≤ 1.29
Schema & Structured Data for WP & AMP <= 1.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via How To and FAQ Blocks
- Medium 5.4
CVE-2023-51677login required≤ 1.23
WordPress Schema & Structured Data for WP & AMP Plugin <= 1.23 is vulnerable to Cross Site Scripting (XSS)
- Medium 5.4
CVE-2024-22146login required≤ 1.25
WordPress Schema & Structured Data for WP & AMP Plugin <= 1.25 is vulnerable to Cross Site Scripting (XSS)
- Medium 5.4
CVE-2024-5582contributor+≤ 1.33
Schema & Structured Data for WP & AMP <= 1.33 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Attribute
- Medium 5.3
CVE-2024-49683unauthenticated≤ 1.3.5
WordPress Schema & Structured Data for WP & AMP plugin <= 1.3.5 - Sensitive Data Exposure vulnerability
The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).