What is GHSA-7x27-h8wx-cfpr?

GHSA-7x27-h8wx-cfpr is a security advisory published by GitHub Security Advisories with Low severity. The Schema \u0026 Structured Data for WP \u0026 AMP WordPress plugin before 1.67 does not perform a...

Which CVE IDs does GHSA-7x27-h8wx-cfpr cover?

GHSA-7x27-h8wx-cfpr covers the following CVE IDs: CVE-2026-82127. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-7x27-h8wx-cfpr?

GHSA-7x27-h8wx-cfpr has a CVSS v3 base score of 3.5, published by GitHub Security Advisories.

GHSA-7x27-h8wx-cfprLowCVSS 3.5

The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not perform a...

Vendor

GitHub Security Advisories

Published

September 30, 2026

Last Modified

September 30, 2026

🔗 CVE IDs covered (1)

CVE-2026-82127 →

📋 Description

The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not perform a capability check when saving several of its fields, nor escape them when outputting them back, allowing users with the editor role and above to inject arbitrary web scripts that execute when a higher privileged user views the affected screen. This is only exploitable on multisite installs, where editors do not hold the unfiltered_html capability.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-82127
https://wpscan.com/vulnerability/fa992935-6764-407e-a95f-31c55c33bf38
https://github.com/advisories/GHSA-7x27-h8wx-cfpr