Schema & Structured Data for WP & AMP: Stored cross-site scripting via Pretty Print
Summary
The WordPress plugin Schema & Structured Data for WP & AMP does not safely encode its structured data output when the Pretty Print option is enabled. An authenticated user with the Contributor role or higher can store malicious script in a custom field mapped to a schema property. The script runs in the browsers of visitors and editors, and an administrator viewing a poisoned page could have their session hijacked.
Affected
- Schema & Structured Data for WP & AMP, all versions before 1.70 (per the CVE record, 0 to < 1.70)
- Only sites with the Pretty Print option enabled and a schema property mapped to a custom field are affected by default settings being changed
Fixed in
- Version 1.70 or later (vendor release note dated 2 November 2026; the release note does not name this CVE, so the link is inferred)
Workaround
- Disable the Pretty Print option (third-party suggestion, not vendor-issued)
- Review which accounts have Contributor or higher roles and limit who can edit custom fields mapped to schema properties
Exploitation
- Not listed in CISA KEV; no evidence of in-the-wild exploitation found
- CISA SSVC: exploitation none, not automatable, total technical impact
- Conflicting reports: one OffSeq snapshot reports no public exploit code, a later one reports a public Nuclei detection template; not verified
- Public proof of concept: unknown
Our recommendation
- Update the plugin to version 1.70 or later now
- Until the update is applied, disable Pretty Print and review Contributor-or-higher accounts and custom field editing rights
- Check existing schema output and page content for injected script code
- Monitor for unusual edits to custom fields and for administrator sessions on recently changed pages
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan advisory wpscan.com
- CVE Record CVE-2026-119035 www.cve.org
- VulDB CVE-2026-119035 vuldb.com
- Plugin release notes version 1.70 structured-data-for-wp.com
- WordPress.org plugin page wordpress.org
- OffSeq threat radar radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 13:45.
Original description (NVD)
The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not safely encode its structured data output when the Pretty Print option is enabled, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks when the site maps a schema property to a custom field.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.