CVE-2026-96666Published
Schema App Structured Data <= 2.3.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via 'Remove Microdata' Output Filter
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-96666 · Microsoft / collected KEV context
cve-program · CVE-2026-96666
- https://www.wordfence.com/threat-intel/vulnerabilities/id/7e0a6ba5-6b2a-49b2-8780-df5eb6a5eecd?source=cve
- https://plugins.trac.wordpress.org/browser/schema-app-structured-data-for-schemaorg/tags/2.3.2/lib/SchemaFront.php#L547
- https://plugins.trac.wordpress.org/browser/schema-app-structured-data-for-schemaorg/tags/2.3.2/lib/SchemaFront.php#L541
- https://plugins.trac.wordpress.org/browser/schema-app-structured-data-for-schemaorg/tags/2.3.2/lib/SchemaFront.php#L40
Related operational evidence
Explicit CVE identifiers- Schema App Structured Data <= 2.3.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via 'Remove Microdata' Output Filter · Newly collected advisory · 29 Oct 2026