PT-2026-4323 · WordPress · Schema & Structured Data For Wp & Amp

Published 2026-01-23 · Updated 2026-01-23 · CVE-2025-14069

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Schema & Structured Data for WP & AMP plugin for WordPress versions through 1.54

Description The Schema & Structured Data for WP & AMP plugin for WordPress is susceptible to Stored Cross-Site Scripting. The issue stems from inadequate input sanitization and output escaping in the saswp custom schema field profile field. This allows authenticated attackers with Contributor-level access or higher to inject malicious web scripts into pages. When a user accesses an affected page, the injected scripts will execute.

Recommendations Update the Schema & Structured Data for WP & AMP plugin for WordPress to a version later than 1.54.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-14069

Affected Products

Schema & Structured Data For Wp & Amp

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-14069 · Security Note
• https://t.me/cveNotify/149650 · Telegram Post
• https://plugins.trac.wordpress.org/browser/schema-and-structured-data-for-wp/tags/1.53/admin_section/structure-admin.php#L2605 · Note
• https://plugins.trac.wordpress.org/changeset/3441582/schema-and-structured-data-for-wp/trunk?contextall=1&old=3429983&old_path=%2Fschema-and-structured-data-for-wp%2Ftrunk#file0 · Note
• https://twitter.com/VulmonFeeds/status/2014617277010772093 · Twitter Post
• https://twitter.com/CVEnew/status/2014576936174158259 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/651a7036-d421-41b7-91db-102e60d8274e?source=cve · Note
• https://plugins.trac.wordpress.org/browser/schema-and-structured-data-for-wp/tags/1.53/admin_section/common-function.php#L1874 · Note
• https://t.me/CVEtracker/42812 · Telegram Post
• https://plugins.trac.wordpress.org/browser/schema-and-structured-data-for-wp/tags/1.53/output/function.php#L171 · Note