CVE-2026-3604 is a stored cross-site scripting vulnerability in the WP SEO Structured Data Schema WordPress plugin affecting all versions up to 2.8.1. The flaw exists due to improper neutralization of input in the _kcseo_ative_tab parameter, allowing authenticated users with Contributor-level permissions or higher to inject arbitrary web scripts. These scripts execute when any user accesses the injected page, potentially compromising user sessions or data. The vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 4.9, reflecting medium severity with network attack vector, high attack complexity, low privileges required, no user interaction, and impact on confidentiality and integrity but not availability.

An attacker with Contributor-level or higher access can store malicious scripts in the plugin's input parameter, which will execute in the context of other users viewing the affected pages. This can lead to unauthorized actions or data disclosure limited to the scope of the XSS vulnerability. The impact is rated medium severity with partial confidentiality and integrity impact but no availability impact. There are no reports of active exploitation in the wild.

No official patch or remediation guidance is currently available from the vendor. Users should monitor the vendor advisory for updates and consider restricting Contributor-level access until a fix is released. Applying general WordPress security best practices to limit user permissions may reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.