CVE-2024-1586 is a stored cross-site scripting vulnerability in the magazine3 Schema & Structured Data for WP & AMP plugin for WordPress. The flaw exists due to improper neutralization of input during web page generation, specifically in the custom schema feature. Authenticated attackers with admin or delegated lower roles can inject arbitrary scripts that execute in the context of users visiting the injected pages. This vulnerability affects all plugin versions up to 1.26. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, and impacts confidentiality and integrity with no availability impact.

Successful exploitation allows an authenticated user to inject malicious scripts that execute in other users' browsers when they access the compromised pages. This can lead to information disclosure and integrity issues such as session hijacking or unauthorized actions performed in the context of the victim user. The vulnerability requires at least subscriber-level privileges, but by default requires admin privileges, limiting exposure to trusted users with elevated permissions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict plugin access to trusted administrators only and review user role assignments carefully to prevent lower-privileged users from exploiting this vulnerability. Monitor for plugin updates from magazine3 and apply official fixes promptly once released.