CVE-2026-119035

Name of the Vulnerable Software and Affected Versions Schema & Structured Data for WP & AMP versions prior to 1.70

Description Insufficient input sanitization and output escaping occur when the Pretty Print option is enabled and the site maps a schema property to a custom field. This allows authenticated users with a role as low as Contributor to perform Stored Cross-Site Scripting (XSS) attacks, which is a method of injecting malicious scripts into a webpage that are then stored on the server and executed in the browsers of other users who visit the affected page.

Recommendations Update Schema & Structured Data for WP & AMP to version 1.70 or later.