The WP SEO Structured Data Schema plugin is vulnerable to stored Cross‑Site Scripting because the _kcseo_ative_tab parameter is not properly sanitised or escaped. An authenticated user with Contributor or higher privileges can post malicious script code that will be stored and executed whenever anyone views the affected page, compromising confidentiality, integrity, and potentially enabling a full attacker takeover. This is a typical input validation weakness identified as CWE‑79.

The vulnerability affects the WP SEO Structured Data Schema plugin distributed by kcseopro as published in WordPress, in all versions up to and including 2.8.1. Any WordPress site that has the plugin installed and allows contributors or higher roles to edit its settings is at risk.

The CVSS score of 4.9 indicates a medium risk level. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog, implying no publicly known exploits yet. The attack requires a valid contributor‑level account; an attacker could legitimately obtain such credentials or compromise an existing account. Once the malicious script is stored, any user visiting the affected page would execute it, making this a serious threat for sites that rely on the plugin.