CVE-2026-119035 · Package
NO FIX YET · SEE WHAT TO DO
The Schema & Structured Data for WP & AMP WordPress plugin does not safely encode its structured data output when the Pretty Print option is enabled. A user with Contributor role or higher can store script that runs in other visitors' browsers when a schema property is mapped to a custom field.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the Schema & Structured Data for WP & AMP plugin before 1.70 with the Pretty Print option enabled and at least one schema property mapped to a custom field. Exposure requires a Contributor-level account or higher, so sites with no untrusted contributors have lower risk. Sites without the Pretty Print option or without those field mappings are not described as affected.
Not affected if no-custom-field-mapping, plugin-1.70-or-later, pretty-print-off
Who cares self-hosted, wordpress, wordpress-plugin
1.70.1.70 or later.The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not safely encode its structured data output when the Pretty Print option is enabled, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks when the site maps a schema property to a custom field.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.