{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/schema--structured-data-for-wp--amp--1.67/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:schema_and_structured_data_for_wp_and_amp_project:schema_and_structured_data_for_wp_and_amp:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-96570"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Schema \u0026 Structured Data for WP \u0026 AMP (\u003c= 1.67)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["WordPress"],"content_html":"\u003cp\u003eThe Schema \u0026amp; Structured Data for WP \u0026amp; AMP plugin for WordPress (all versions up to and including 1.67) contains a critical security flaw involving insufficient input sanitization and output escaping. Specifically, the 'saswp_review_text' parameter fails to properly filter user-supplied content, allowing unauthenticated attackers to perform stored Cross-Site Scripting (XSS) attacks. The security mechanism intended to prevent unauthorized submissions - a nonce - is rendered ineffective because it is publicly printed within the HTML of the [saswp-reviews-form] shortcode. An attacker can scrape this nonce from the front-end of a site and use it to successfully submit malicious script payloads, which will subsequently execute in the browser of any user or administrator who views the compromised review content.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of a victim's session. This could lead to account takeover, unauthorized actions performed on behalf of authenticated users, or the redirection of site visitors to malicious domains. The vulnerability affects any WordPress site utilizing the Schema \u0026amp; Structured Data for WP \u0026amp; AMP plugin version 1.67 or earlier.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade to the latest version of the Schema \u0026amp; Structured Data for WP \u0026amp; AMP plugin that addresses the sanitization and nonce-exposure vulnerabilities immediately.\u003c/li\u003e\n\u003cli\u003eAudit existing reviews for injected script tags using server-side logs or database inspection if the site was publicly accessible during the period of vulnerability.\u003c/li\u003e\n\u003cli\u003eDeploy web application firewall (WAF) rules to detect and block suspicious HTTP POST requests containing script tags or common XSS payloads directed at the review submission endpoint.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-16T06:29:00Z","date_published":"2026-10-16T06:29:00Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-96570/","summary":"The Schema \u0026 Structured Data for WP \u0026 AMP plugin is vulnerable to unauthenticated stored XSS via the 'saswp_review_text' parameter due to insufficient input sanitization and an exposed, ineffective nonce.","title":"Stored Cross-Site Scripting in Schema \u0026 Structured Data for WP \u0026 AMP","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-96570/"}],"language":"en","title":"CraftedSignal Threat Feed - Schema \u0026 Structured Data for WP \u0026 AMP (\u003c= 1.67)","version":"https://jsonfeed.org/version/1.1"}