Stored Cross-Site Scripting in Schema & Structured Data for WP & AMP

The Schema & Structured Data for WP & AMP plugin for WordPress (all versions up to and including 1.67) contains a critical security flaw involving insufficient input sanitization and output escaping. Specifically, the 'saswp_review_text' parameter fails to properly filter user-supplied content, allowing unauthenticated attackers to perform stored Cross-Site Scripting (XSS) attacks. The security mechanism intended to prevent unauthorized submissions - a nonce - is rendered ineffective because it is publicly printed within the HTML of the [saswp-reviews-form] shortcode. An attacker can scrape this nonce from the front-end of a site and use it to successfully submit malicious script payloads, which will subsequently execute in the browser of any user or administrator who views the compromised review content.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of a victim's session. This could lead to account takeover, unauthorized actions performed on behalf of authenticated users, or the redirection of site visitors to malicious domains. The vulnerability affects any WordPress site utilizing the Schema & Structured Data for WP & AMP plugin version 1.67 or earlier.

Recommendation

1. Upgrade to the latest version of the Schema & Structured Data for WP & AMP plugin that addresses the sanitization and nonce-exposure vulnerabilities immediately.
2. Audit existing reviews for injected script tags using server-side logs or database inspection if the site was publicly accessible during the period of vulnerability.
3. Deploy web application firewall (WAF) rules to detect and block suspicious HTTP POST requests containing script tags or common XSS payloads directed at the review submission endpoint.