PT-2025-44706 · WordPress · Schema Scalpel

Peter Thaleikis

·

CVE-2025-12118

·

Publicado

2025-11-01

·

Atualizado

2025-11-20

CVSS v3.1

6.4

Média

VetorAV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Schema Scalpel versions prior to 1.6.2
Description The Schema Scalpel plugin for WordPress is susceptible to Stored Cross-Site Scripting. This is due to inadequate input sanitization and output escaping when handling user-supplied data in the post title, specifically when generating JSON-LD schema markup. Authenticated attackers with Contributor-level access or higher can inject malicious web scripts into pages. These scripts will execute when a user accesses the compromised page.
Recommendations Update Schema Scalpel to version 1.6.2 or later.

Exploit

Correção

XSS

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-12118

Produtos afetados

Schema Scalpel