The plugin allows a user to submit product reviews via the 'saswp_review_text' field. Because the input is not properly sanitized or escaped, data stored by the plugin can include JavaScript that is later rendered in the review page. The vulnerability permits any visitor to enter malicious script that will run on browsers of anyone who views the review, compromising confidentiality, integrity, and potentially allowing session hijacking. This is a Classic Stored Cross‑Site Scripting flaw identified as CWE‑79.

WordPress plugin “Schema & Structured Data for WP & AMP” from magazine3. All releases through 1.67 are vulnerable. Users running any of those versions should consider them compromised.

The CVSS v3.1 base score is 7.2 (Medium‑High), indicating significant risk. An EPSS score of 0.00314 (< 1 %) indicates a low but nonzero exploitation probability, and the flaw is not present in CISA’s KEV catalog. However, the lack of an adequate authorization gate – the nonce is publicly exposed in the shortcode output – means an attacker does not need credentials. Attack flow is straightforward: craft a review containing malicious code, submit it via the front‑end review form, and that code will be stored and subsequently served to site visitors. The vulnerability thus has a high likelihood of exploitation in a compromised site.