CVE-2026-96666

Name of the Vulnerable Software and Affected Versions Schema App Structured Data plugin for WordPress versions prior to 2.3.3

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping within the 'Remove Microdata' output filter. Unauthenticated attackers can inject arbitrary web scripts into comment content. These scripts execute when a user accesses the affected page, provided an administrator has enabled the 'Remove Microdata' option and approved the malicious comment.

Recommendations Update the plugin to version 2.3.3 or later. As a temporary mitigation, disable the 'Remove Microdata' option.