The Schema & Structured Data for WP & AMP WordPress plugin prior to version 1.67 contains a CWE-79 Cross-Site Scripting vulnerability. It arises from missing capability checks during field saving and improper output escaping. Users with editor privileges on multisite installations can inject malicious scripts that execute in the context of higher privileged users viewing the affected interface. This issue does not affect single site installs or users with unfiltered_html capability.

An attacker with editor role on a multisite WordPress installation can inject arbitrary JavaScript code that executes in the browser of higher privileged users (e.g., administrators) when they view the affected plugin screens. This could lead to session hijacking, privilege escalation, or other malicious actions performed with the victim's privileges. The impact is limited to multisite environments and requires the attacker to have editor-level access.

Upgrade the Schema & Structured Data for WP & AMP plugin to version 1.67 or later, where this vulnerability is fixed. Until then, restrict editor role permissions on multisite installations or avoid using the affected plugin version. No official patch link is provided in the input, so verify the vendor advisory for the latest remediation status.