CVE-2026-3604 is a stored cross-site scripting vulnerability in the WP SEO Structured Data Schema WordPress plugin. The issue is due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of the _kcseo_ative_tab parameter. Authenticated users with Contributor-level privileges or above can inject arbitrary JavaScript that executes in the context of other users viewing the injected pages. This vulnerability affects all plugin versions up to 2.8.1. The CVSS 3.1 base score is 4.9, reflecting network attack vector, high attack complexity, low privileges required, no user interaction, and partial confidentiality and integrity impact.

An attacker with Contributor-level or higher access can inject persistent malicious scripts into pages generated by the plugin. These scripts execute in the browsers of users who access the compromised pages, potentially leading to unauthorized actions or data disclosure within the context of the affected site. The impact is limited to confidentiality and integrity, with no availability impact reported. No known exploitation in the wild has been documented.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit Contributor-level access to trusted users only and consider monitoring or restricting use of the _kcseo_ative_tab parameter if possible. Avoid exposing pages that could contain injected scripts to untrusted users. Follow updates from the plugin vendor for an official patch or mitigation instructions.