¿Es seguro Schema And Structured Data For Wp?

Qué hace este plugin

• Slug: schema-and-structured-data-for-wp
• 100000+ instalaciones activas

amprich snippetsschemaseostructured data

Estado de mantenimiento

• Última versión conocida: 1.62
• Requiere PHP: 5.6.20+
• PHP máximo soportado (analizado): 8.4

Vulnerabilidades conocidas

10 CVEs conocidos registrados para Schema And Structured Data For Wp.

CVE-2026-9067

The Schema & Structured Data for WP & AMP WordPress plugin before 1.60 does not check user capabilities on its frontend AJAX file-upload handlers and does not validate the actual content of uploaded files against the endpoint's intended media type, allowing unauthenticated users to upload any file type accepted by WordPress's media library through endpoints that should only accept images or videos.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2025-14069

The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswp_custom_schema_field' profile field in all versions up to, and including, 1.54 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2025-11502

The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'saswp_tiny_multiple_faq' shortcode in all versions up to, and including, 1.51 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-49683

<p>WordPress Schema & Structured Data for WP & AMP Plugin <= 1.3.5 is vulnerable to Sensitive Data Exposure</p><p>Software: Schema & Structured Data for WP & AMP</p><p>Link: https://wordpress.org/plugins/schema-and-structured-data-for-wp/#developers</p><p>Affected Version <= 1.3.5</p><p>Fixed in version 1.36 </p>

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2024-5582

The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'url' attribute within the Q&A Block widget in all versions up to, and including, 1.33 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-3491

The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's "How To" and "FAQ" Blocks in all versions up to, and including, 1.29 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-1288

Update the WordPress Schema & Structured Data for WP & AMP plugin to the latest available version (at least 1.27). Ngô Thiên An (ancorn_) discovered and reported this Broken Access Control vulnerability in WordPress Schema & Structured Data for WP & AMP Plugin. A broken access control issue refers to a missing authorization, authentication or nonce token check in a function that could lead to an unprivileged user to executing a certain higher privileged action. This vulnerability has been fixed in version 1.27. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2024-1586

Update the WordPress Schema & Structured Data for WP & AMP plugin to the latest available version (at least 1.27). Sh discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Schema & Structured Data for WP & AMP Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 1.27. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

+ 4 vulnerabilidades conocidas más

CVE	Vulnerabilidad	Tipo	Gravedad	Afectadas	Corregido en	Publicado	Estado
CVE-2024-22146	Schema & Structured Data for WP & AMP [schema-and-structured-data-for-wp] < 1.26	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,5	< 1.26	1.26	2024-01-15	✓ corregido en la última versión
—	Schema & Structured Data for WP & AMP [schema-and-structured-data-for-wp] < 1.26	—	Desconocido	< 1.26	1.26	2024-01-12	✓ corregido en la última versión
CVE-2023-51677	Schema & Structured Data for WP & AMP [schema-and-structured-data-for-wp] < 1.24	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 6,5	< 1.24	1.24	2023-12-27	✓ corregido en la última versión
—	Schema & Structured Data for WP & AMP [schema-and-structured-data-for-wp] < 1.50	—	Media 6,1	< 1.50	1.50	0000-00-00	✓ corregido en la última versión

CVE-2024-22146

Update the WordPress Schema & Structured Data for WP & AMP plugin to the latest available version (at least 1.26). LVT-tholv2k discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Schema & Structured Data for WP & AMP Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 1.26. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Schema & Structured Data for WP & AMP [schema-and-structured-data-for-wp] < 1.26

The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.25 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2023-51677

Update the WordPress Schema & Structured Data for WP & AMP plugin to the latest available version (at least 1.24). LVT-tholv2k discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Schema & Structured Data for WP & AMP Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 1.24. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Schema & Structured Data for WP & AMP [schema-and-structured-data-for-wp] < 1.50

The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post comments in all versions up to, and including, 1.49 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Cómo solucionarlo

Mantén Schema And Structured Data For Wp actualizado — 1.62 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• AMP — 400000+ instalaciones activas — 76/100 (367) — PHP máx. 8.4
• Ad Inserter – Ad Manager & AdSense Ads — 300000+ instalaciones activas — 98/100 (2426) — PHP máx. 8.4
• Head, Footer and Post Injections — 200000+ instalaciones activas — 98/100 (735) — PHP máx. 8.4
• AMP for WP – Accelerated Mobile Pages — 80000+ instalaciones activas — 88/100 (1317)
• Web Stories — 60000+ instalaciones activas — 84/100 (85)