The Schema & Structured Data for WP & AMP WordPress plugin fails to perform a capability check when saving taxonomy term fields and does not escape user‑supplied data upon output. Consequently, users with the editor role or higher can inject arbitrary JavaScript that will execute when a higher‑privileged user views the term screen. This stored cross‑site scripting can compromise the integrity of the site’s data and allow privileged users to run malicious code in their own browser context.

All versions of the Schema & Structured Data for WP & AMP plugin released before 1.67 are affected. The vulnerability is exploitable only on multisite WordPress installations, where editors do not possess the unfiltered_html capability, creating a narrow attack surface. Single‑site sites are not vulnerable because editors typically retain full unfiltered_html rights.

The CVSS score of 3.5 indicates a low severity, but the presence of stored cross‑site scripting still poses a risk to privileged users. The EPSS score of <1% suggests a very low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. An attacker must first be a user with the editor role or higher on a multisite network and must create or edit a taxonomy term; once the malicious script is stored it will run in the browser of any administrator or higher‑privileged user who accesses the affected screen.