The Schema Scalpel WordPress plugin is vulnerable to stored cross‑site scripting when a user with Contributor or higher privileges modifies a post title. The title content is inserted, without proper sanitization or escaping, into a JSON‑LD schema block rendered on the post page. This flaw allows an authenticated attacker to embed arbitrary JavaScript that runs in the browsers of any visitor who views the affected page, making defacement, data theft or session hijacking possible. The weakness is a classic stored XSS defect due to improper input handling and output escaping.

WordPress sites that have the Schema Scalpel plugin installed in version 1.6.1 or earlier. The plugin is distributed by kevingillispie and is available through the official WordPress plugin repository. Identify affected systems by checking the plugin’s presence and version in the WordPress dashboard or the site’s file system.

With a CVSS score of 6.4, the vulnerability carries a moderate severity. The EPSS score of less than 1% indicates a low likelihood of exploitation in the wild at the time of this analysis, and the defect is not listed in the CISA KEV catalog. An attacker must first obtain authenticated access with at least Contributor privileges, then edit a post title to include malicious payloads. Once submitted, the payload executes in the context of all site visitors who view the page that contains the affected JSON‑LD markup.