Threats tagged 'ghsa-rv4v-2c82-p7gc'

The Schema App Structured Data plugin for WordPress versions up to and including 2.3.2 contains a stored cross-site scripting (XSS) vulnerability via comment content when the 'Remove Microdata' output filter is enabled. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users view the affected pages. Exploitation requires that an administrator has enabled the 'Remove Microdata' option and approved the malicious comment.