CVE-2026-119035: Schema & Structured Data for WP & AMP < 1.70 - Contributor+ Stored XSS via JSON-LD Pretty Print

Q: Which sites are exposed to this issue?

Sites using Schema & Structured Data for WP & AMP versions earlier than 1.70 are affected when Pretty Print is enabled and a schema property is mapped to a custom field.

Q: What access does an attacker need?

An attacker needs an account with at least the Contributor role and the ability to supply content to the custom field mapped into the schema property.

Q: Is the default configuration affected?

The issue requires Pretty Print to be enabled and a schema property to use a custom-field mapping. The available information does not state whether those settings are enabled by default.

Q: How can I check whether my site is at risk?

Check whether the plugin version is earlier than 1.70, whether Pretty Print is enabled, and whether any schema properties are populated from custom fields that Contributors can influence.

Published Nov 11, 2026

Updated

The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not safely encode its structured data output when the Pretty Print option is enabled, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks when the site maps a schema property to a custom field.

Affected Software

1 affected component

Schema & Structured Data for WP & AMP<1.70

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Schema & Structured Data for WP & AMP to a version that resolves this vulnerability.
Fixed in 1.70

Event History

Nov 11, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Which sites are exposed to this issue?

Sites using Schema & Structured Data for WP & AMP versions earlier than 1.70 are affected when Pretty Print is enabled and a schema property is mapped to a custom field.

What access does an attacker need?

An attacker needs an account with at least the Contributor role and the ability to supply content to the custom field mapped into the schema property.

Is the default configuration affected?

The issue requires Pretty Print to be enabled and a schema property to use a custom-field mapping. The available information does not state whether those settings are enabled by default.

How can I check whether my site is at risk?

Check whether the plugin version is earlier than 1.70, whether Pretty Print is enabled, and whether any schema properties are populated from custom fields that Contributors can influence.

CVE-2026-119035: Schema & Structured Data for WP & AMP < 1.70 - Contributor+ Stored XSS via JSON-LD Pretty Print

Affected Software

Remediation

Event History

Frequently Asked Questions

Which sites are exposed to this issue?

What access does an attacker need?

Is the default configuration affected?

How can I check whether my site is at risk?

Company

Resources

Contact

Frequently Asked Questions

Which sites are exposed to this issue?

What access does an attacker need?

Is the default configuration affected?

How can I check whether my site is at risk?