Schema App Structured Data: Stored Cross-Site Scripting (CVE-2026-96666)
The Schema App Structured Data plugin for WordPress through version 2.3.2 is vulnerable to stored cross-site scripting due to insufficient sanitization of comment content when the 'Remove Microdata' feature is active.
CVE search metadata
CVE search record: CVE-2026-96666. Severity: high. CVSS: 7.2. KEV: no. Product: Schema App Structured Data (<= 2.3.2). Brief: Schema App Structured Data: Stored Cross-Site Scripting (CVE-2026-96666). Brief link: https://feed.craftedsignal.io/briefs/2026-10-schema-app-xss/
Triage facts
Revision 1- Applicability
- Schema App Structured Data (<= 2.3.2)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 29, 07:09 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
The Schema App Structured Data plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability via the 'Remove Microdata' output filter. The vulnerability affects all versions up to and including 2.3.2. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts into comment fields.
Impact
Successful exploitation results in arbitrary script execution in the context of any user, including administrators, who views an affected page where the malicious comment has been approved.
Recommendation
- Identify all WordPress instances running the Schema App Structured Data plugin.
- Disable the 'Remove Microdata' feature until the plugin is updated to a patched version.
- Review existing comment sections for anomalous script tags or obfuscated JavaScript, particularly in pending approval queues.
- Prioritize monitoring for administrative account actions occurring shortly after the approval of new user comments.
Immediate actions
Disable 'Remove Microdata' option in Schema App Structured Data plugin settings.
Threat Hunt
Search WordPress comments for script tags or common XSS patterns.
Data: WordPress wp_comments table or administrative comment moderation logs
Mitigations
Upgrade or disable plugin until security patch is released by vendor.
CVE-2026-96666