Schema App - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/schema-app/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 07:09:15 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSchema App Structured Data: Stored Cross-Site Scripting (CVE-2026-96666)https://feed.craftedsignal.io/briefs/2026-10-schema-app-xss/Thu, 29 Oct 2026 07:09:15 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-schema-app-xss/The Schema App Structured Data plugin for WordPress through version 2.3.2 is vulnerable to stored cross-site scripting due to insufficient sanitization of comment content when the 'Remove Microdata' feature is active.The Schema App Structured Data plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability via the 'Remove Microdata' output filter. The vulnerability affects all versions up to and including 2.3.2. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts into comment fields.

Impact

Successful exploitation results in arbitrary script execution in the context of any user, including administrators, who views an affected page where the malicious comment has been approved.

Recommendation

  • Identify all WordPress instances running the Schema App Structured Data plugin.
  • Disable the 'Remove Microdata' feature until the plugin is updated to a patched version.
  • Review existing comment sections for anomalous script tags or obfuscated JavaScript, particularly in pending approval queues.
  • Prioritize monitoring for administrative account actions occurring shortly after the approval of new user comments.
]]>highadvisorywordpressxssweb-application