Schema & Structured Data for WP & AMP <= 1.68 - Unauthenticated Arbitrary Shortcode Execution via Review Text
- ID
- WPSEC-2026-2002
- Plugin
- Schema & Structured Data for WP & AMP (schema-and-structured-data-for-wp)
- Affected
- all versions before 1.69
- Remediation
- Update to 1.69 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
- Weakness
- CWE-94
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-30
- Attack surface
- Schema & Structured Data for WP & AMP on WPSec AttackSurface
- Fix released
- Published
Description
The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to arbitrary shortcode execution via the review text submitted through the front-end review form in all versions up to, and including, 1.68. This is due to the plugin keeping shortcodes in submitted review text and adding review collections to post content on the 'the_content' filter before WordPress runs do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes on pages where a review collection is placed automatically through its display setting (before, after or inside the content), once an administrator has published their review.
References
- https://wpsec.com/vuln/WPSEC-2026-2002/
- https://plugins.svn.wordpress.org/schema-and-structured-data-for-wp/tags/1.69/
- https://wordpress.org/plugins/schema-and-structured-data-for-wp/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS