Veille CVE

Recherche « Unknown Schema & Structured Data for WP & AMP »

5 CVE

Critique 1 Élevée 0 Moyenne 2 Faible 2 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Unknown Schema & Structured Data for WP & AMP » ✕
  1. CVE-2026-82127 3.5 Faible

    Unknown Schema & Structured Data for WP & AMP

    The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not perform a capability check when saving several of its fields, nor escape them when outputting them back, allowing users with the editor role and above to inject arbitrary web scripts that execute when a higher privileged user views the affected screen. This is only exploitable on multisite installs, where editors do not hold the unfiltered_html capability.

  2. CVE-2026-82126 2.7 Faible

    Unknown Schema & Structured Data for WP & AMP

    The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check that a user is allowed to edit the specific post they request schema generation for, allowing users with the contributor role and above to obtain the content of other users' draft, pending, private and password protected posts.

  3. CVE-2026-82125 5.3 Moyenne

    Unknown Schema & Structured Data for WP & AMP

    The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not correctly verify the ownership or the moderation status of a comment before returning its content, allowing unauthenticated users to read the content of comments still awaiting moderation or marked as spam.

  4. CVE-2026-82124 5.3 Moyenne

    Unknown Schema & Structured Data for WP & AMP

    The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check whether a post is password protected before including its content in the structured data it generates, allowing unauthenticated users to obtain the content of password protected posts via more than one public output route.

  5. CVE-2026-9067 9.1 Critique

    Unknown Schema & Structured Data for WP & AMP

    The Schema & Structured Data for WP & AMP WordPress plugin before 1.60 does not check user capabilities on its frontend AJAX file-upload handlers and does not validate the actual content of uploaded files against the endpoint's intended media type, allowing unauthenticated users to upload any file type accepted by WordPress's media library through endpoints that should only accept images or videos.