Is CVE-2026-119035 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-119035 being exploited in the wild.

How severe is CVE-2026-119035?

Informational severity, published 11 November 2026.

Which products and versions are affected?

Rank Math Schema & Structured Data for WP & AMP before 1.70.

Is there a fix for CVE-2026-119035?

Yes: fixed in 1.70. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-119035 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-119035?

Check whether you run Rank Math Schema & Structured Data for WP & AMP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119035: Schema & Structured Data for WP & AMP stored cross-site scripting in JSON-LD

CVE-2026-119035 · Severity: info · Published 2026-11-11

A WordPress plugin that generates schema markup for search engines contains a flaw in its JSON-LD output formatting that allows contributors (low-privilege users) to inject malicious scripts. When the Pretty Print option is enabled and a schema property is mapped to a custom field, attackers can craft payloads that execute in visitors' browsers, potentially stealing credentials, defacing content, or spreading malware across the affected site.

Vendors: Rank Math.

Quick answers

Is CVE-2026-119035 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-119035 being exploited in the wild.
How severe is CVE-2026-119035?: Informational severity, published 11 November 2026.
Which products and versions are affected?: Rank Math Schema & Structured Data for WP & AMP before 1.70.
Is there a fix for CVE-2026-119035?: Yes: fixed in 1.70. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-119035 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-119035?: Check whether you run Rank Math Schema & Structured Data for WP & AMP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.70

Technical details

The plugin fails to properly encode structured data output when the Pretty Print option is enabled, creating a stored XSS vulnerability. An authenticated attacker with Contributor role or higher can inject malicious JavaScript via custom fields mapped to schema properties; the unescaped payload is then reflected in the JSON-LD output on the site frontend, executing in all visitors' browsers.

Affected products

Rank Math Schema & Structured Data for WP & AMP before 1.70

Timeline

2026-11-09: disclosed
2026-11-11: advisory

References

https://wpscan.com/vulnerability/f8fb358e-e0aa-4a4d-a4d0-b6f383b115a2/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.