CVE-2026-82127: Schema & Structured Data for WP & AMP < 1.67 - Editor+ Stored XSS via Taxonomy Term Fields
The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not perform a capability check when saving several of its fields, nor escape them when outputting them back, allowing users with the editor role and above to inject arbitrary web scripts that execute when a higher privileged user views the affected screen. This is only exploitable on multisite installs, where editors do not hold the unfilteredhtml capability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Schema & Structured Data for WP & AMPto a version that resolves this vulnerability.Fixed in 1.67
Event History
Frequently Asked Questions
Which deployments are exposed to exploitation?
Exploitation is limited to WordPress multisite installations using versions earlier than 1.67. The relevant condition is that editors lack the unfiltered_html capability, as is the case on multisite installs.
What access does an attacker need?
An attacker needs an account with the editor role or higher and access to save the affected taxonomy term fields. The injected script executes when a higher-privileged user later views the affected screen.
What should be prioritized for remediation?
Update the plugin to version 1.67 or later. Until updating is possible, restrict editor-and-higher access to the affected taxonomy term fields and review those fields for injected script content.