CVE-2026-96570 in Schema & Structured Data for WP & AMP Plugin
Summary
by MITRE • 10/16/2026
The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswp_review_text' parameter in all versions up to, and including, 1.67 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce that serves as the only authorization gate is publicly printed in the [saswp-reviews-form] shortcode HTML, making it obtainable by any anonymous visitor and rendering it ineffective as an access control boundary.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/16/2026
The Schema & Structured Data for WP & AMP plugin represents a significant attack surface within WordPress ecosystems due to its handling of user-generated content in structured data contexts. The vulnerability identified affects all versions up to and including 1.67, stemming from fundamental flaws in input validation and output encoding mechanisms. Specifically, the saswp_review_text parameter lacks sufficient sanitization upon reception and fails to apply appropriate escaping before rendering this data within HTML responses. This architectural oversight allows malicious actors to inject arbitrary JavaScript code into pages that display review content, creating a persistent threat vector known as Stored Cross-Site Scripting or XSS Type I. Unlike reflected attacks which require immediate user interaction with a crafted link, stored vulnerabilities persist on the server side, ensuring that every visitor viewing the compromised page becomes a potential victim without any additional effort from the attacker.
The operational impact of this vulnerability is severe because it bypasses standard authentication requirements for execution context within the browser sandbox. Although the plugin implements a nonce-based authorization mechanism intended to restrict form submissions to authenticated users or legitimate interactions, this control is critically undermined by its implementation method. The security token required to validate requests is embedded directly in the HTML source of the saswp-reviews-form shortcode. Consequently, any anonymous visitor can retrieve this value through simple page inspection tools such as browser developer consoles or network interceptors. This exposure effectively neutralizes the nonce's purpose as an access control boundary, allowing unauthenticated attackers to forge valid-looking submission requests that bypass server-side checks and successfully inject malicious payloads into the database.
From a technical classification perspective, this flaw aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly referred to as Cross-site Scripting. The specific nature of storing the payload in the backend before serving it to users places it firmly within the Stored XSS category rather than Reflected or DOM-based variants. In terms of adversary behavior mapping, this vulnerability facilitates techniques associated with ATT&CK T1059 Command and Scripting Interpreter through JavaScript execution on client systems. Attackers can leverage this capability to perform session hijacking by stealing authentication cookies, deface websites, redirect users to phishing sites, or deploy further malware such as keyloggers that capture sensitive credentials entered into the compromised site.
Mitigation strategies must address both immediate remediation and long-term security hygiene. The primary defense is upgrading the plugin to a version where these sanitization and escaping issues have been resolved by the vendor. Until an update is available, administrators should consider disabling the review functionality if it is not essential for their specific use case or restricting access to the affected endpoints via web application firewall rules that detect common XSS payloads in POST parameters. Furthermore, implementing Content Security Policy headers can significantly reduce the impact of successful injection attempts by restricting the sources from which scripts are allowed to execute. Long-term improvements involve adopting strict input validation frameworks and ensuring all dynamic content is contextually encoded before being inserted into HTML structures, thereby eliminating the root cause of such vulnerabilities in future development cycles.