The Structured Content plugin for WordPress contains a stored cross‑site scripting flaw that is triggered when a contributor or higher user inserts the sc_fs_local_business shortcode with malicious attribute values. Because the plugin does not sanitize or escape these attributes, the injected script is persisted in the post content and executed in the browser of any visitor that loads the page. This allows the attacker to deface the site, steal authentication cookies, or execute additional malicious payloads in the context of site visitors.

The vulnerability affects the Structured Content (JSON‑LD) WordPress plugin, provided by gorbo, in all releases up to and including version 1.6.4. Users who have enabled the sc_fs_local_business shortcode on their sites and have granted contributor or higher roles are exposed.

The issue carries a CVSS score of 6.4, indicating moderate severity, and an EPSS of less than 1 %, suggesting it is unlikely to be widely exploited. It is not listed in the CISA KEV catalog. Attackers need authenticated access with a contributor or higher role, so the threat is limited to sites where such permissions are granted. Once exploited, the vulnerability can lead to site defacement or the execution of arbitrary scripts in the browsers of site visitors.