The plugin has a stored cross‑site scripting flaw in the Price Range field that does not properly sanitize or escape input. An attacker with Contributor or higher privileges can insert malicious JavaScript into the field, which then executes whenever an administrator visits the plugin settings page. This gives the attacker a persistent ability to run arbitrary code in the context of the admin user, enabling session hijacking, credential theft, or site defacement.

The vulnerability exists in the WP SEO Structured Data Schema plugin provided by kcseopro. All releases up to and including version 2.7.11 are affected. Systems running any earlier or later version are not impacted.

The CVSS score of 6.4 rates the flaw as moderate severity. The EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild. Because it requires authenticated Contributor‑level access, the attack vector is limited to users who already have at least that level of permission on the WordPress site. The flaw is not listed in the CISA KEV catalog, reflecting its low observed exploitation risk.