CVE Database /
CVE-2025-11502
CVE · Medium
CVE-2025-11502 — Schema & Structured Data for WP & AMP [schema-and-structured-data-for-wp] < 1.52
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2025-11502
|
Schema & Structured Data for WP & AMP [schema-and-structured-data-for-wp] < 1.52 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
6.4
|
< 1.52
|
1.52 |
2025-10-31 |
—
|
CVE-2025-11502
The Schema & Structured Data for WP & AMP plugin contains a security flaw in its handling of user-submitted data within the 'saswp_tiny_multiple_faq' shortcode. This oversight allows malicious users with contributor-level access or higher to embed unauthorized scripts into website pages, which can then be executed by visitors when those pages are accessed. The vulnerability affects all versions up to and including 1.51.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings