{"id":"CVE-2026-119035","aliases":["EUVD-2026-123180","GHSA-rpqp-cp85-47rm"],"status":"published","title":"Schema \u0026 Structured Data for WP \u0026 AMP \u003c 1.70 - Contributor+ Stored XSS via JSON-LD Pretty Print","description":"The Schema \u0026 Structured Data for WP \u0026 AMP WordPress plugin before 1.70 does not safely encode its structured data output when the Pretty Print option is enabled, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks when the site maps a schema property to a custom field.","severity":{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-14","score":0.00337,"percentile":0.27504,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-11-11T06:00:09Z","modified":"2026-11-11T12:32:44Z","products":[{"vendor":"magazine3","product":"schema \u0026 structured data for wp \u0026 amp"},{"vendor":"unknown","product":"schema \u0026 structured data for wp \u0026 amp"}],"references":[{"url":"https://wpscan.com/vulnerability/f8fb358e-e0aa-4a4d-a4d0-b6f383b115a2/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119035"},{"url":"https://wpscan.com/vulnerability/f8fb358e-e0aa-4a4d-a4d0-b6f383b115a2"},{"url":"https://github.com/advisories/GHSA-rpqp-cp85-47rm"}],"sources":{"cve":[{"id":"CVE-2026-119035","title":"Schema \u0026 Structured Data for WP \u0026 AMP \u003c 1.70 - Contributor+ Stored XSS via JSON-LD Pretty Print","description":"The Schema \u0026 Structured Data for WP \u0026 AMP WordPress plugin before 1.70 does not safely encode its structured data output when the Pretty Print option is enabled, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks when the site maps a schema property to a custom field.","status":"published","published":"2026-11-11T06:00:09.716Z","modified":"2026-11-11T11:38:46.835Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-11T12:57:43.416809Z"}],"euvd":[{"id":"EUVD-2026-123180","description":"The Schema \u0026 Structured Data for WP \u0026 AMP WordPress plugin before 1.70 does not safely encode its structured data output when the Pretty Print option is enabled, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks when the site maps a schema property to a custom field.","status":"published","published":"2026-11-11T06:00:09Z","modified":"2026-11-11T11:38:46Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-11T13:28:47.336858Z"}],"ghsa":[{"id":"GHSA-rpqp-cp85-47rm","title":"The Schema \u0026 Structured Data for WP \u0026 AMP WordPress plugin before 1.70 does not safely encode its...","description":"The Schema \u0026 Structured Data for WP \u0026 AMP WordPress plugin before 1.70 does not safely encode its structured data output when the Pretty Print option is enabled, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks when the site maps a schema property to a custom field.","status":"published","published":"2026-11-11T06:32:40Z","modified":"2026-11-11T12:32:44Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-11T12:34:06.835386Z"}],"nvd":[{"id":"CVE-2026-119035","description":"The Schema \u0026 Structured Data for WP \u0026 AMP WordPress plugin before 1.70 does not safely encode its structured data output when the Pretty Print option is enabled, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks when the site maps a schema property to a custom field.","status":"published","published":"2026-11-11T06:17:15.917Z","modified":"2026-11-12T18:49:18.84Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-11T14:25:07.037694Z"}]}}