{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aschemaappschema_app_structured_datawordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:schemaapp:schema_app_structured_data:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-96666"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Schema App Structured Data (\u003c= 2.3.2)"],"_cs_severities":["high"],"_cs_tags":["wordpress","xss","web-application"],"_cs_type":"advisory","_cs_vendors":["Schema App"],"content_html":"\u003cp\u003eThe Schema App Structured Data plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability via the 'Remove Microdata' output filter. The vulnerability affects all versions up to and including 2.3.2. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts into comment fields.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in arbitrary script execution in the context of any user, including administrators, who views an affected page where the malicious comment has been approved.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all WordPress instances running the Schema App Structured Data plugin.\u003c/li\u003e\n\u003cli\u003eDisable the 'Remove Microdata' feature until the plugin is updated to a patched version.\u003c/li\u003e\n\u003cli\u003eReview existing comment sections for anomalous script tags or obfuscated JavaScript, particularly in pending approval queues.\u003c/li\u003e\n\u003cli\u003ePrioritize monitoring for administrative account actions occurring shortly after the approval of new user comments.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T07:09:15Z","date_published":"2026-10-29T07:09:15Z","id":"https://feed.craftedsignal.io/briefs/2026-10-schema-app-xss/","summary":"The Schema App Structured Data plugin for WordPress through version 2.3.2 is vulnerable to stored cross-site scripting due to insufficient sanitization of comment content when the 'Remove Microdata' feature is active.","title":"Schema App Structured Data: Stored Cross-Site Scripting (CVE-2026-96666)","url":"https://feed.craftedsignal.io/briefs/2026-10-schema-app-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:schemaapp:schema_app_structured_data:*:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}