The Structured Content plugin contains an improper neutralization of input during web page generation, allowing an attacker to store malicious script code via input fields that are later rendered without proper escaping. This stored XSS flaw can be used to inject JavaScript that executes in the context of site visitors, potentially compromising confidentiality and integrity of users who view affected pages.

Gordon Böhme’s Structured Content plugin for WordPress is vulnerable in all releases from the earliest available version up through 1.6.3. Users of any WordPress site that have installed this plugin, regardless of the WordPress core version, are potentially impacted.

With a CVSS score of 6.5 the vulnerability is considered moderate, and an EPSS score of < 1% indicates a low probability of exploitation. It is not listed in the CISA KEV catalog. The likely attack vector is the submission of crafted content through the plugin’s input controls, which is stored and later emitted as part of a page, allowing an attacker to inject JavaScript that executes in the context of site visitors.