Executive brief
The Structured Content plugin for WordPress, which helps site owners manage schema and organized data, contains a security flaw that allows users with 'Contributor' permissions to inject malicious scripts. If a site administrator or visitor views the affected content, these scripts could execute in their browser, potentially leading to unauthorized actions or the theft of sensitive session information. This risk is primarily relevant to websites that allow multiple users to create or edit content.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in the Structured Content plugin for WordPress (versions <= 1.7.0) due to improper neutralization of input during web page generation (CWE-79). An attacker with 'Contributor' level privileges can inject malicious JavaScript into the site's content. The vulnerability requires a victim (such as an administrator) to interact with the affected page for the script to execute. Successful exploitation allows the attacker to perform actions in the context of the victim's browser, including session hijacking or site defacement. As of the advisory date, no official patch has been released.
Affected products
- Gordon Böhme Structured Content <= 1.7.0
Timeline
- 2026-02-24: disclosed: Reported by zaim
- 2026-07-02: advisory: Published by Patchstack