Unpatched XSS flaw with no plugin update
Known security vulnerabilities in the plugin are reported repeatedly with no patch release, and site owners are told to remove it.
Tier I · Proven The best-established problems.
6 public reports · first reported 12 December 2023 · last reported 30 August 2026
What's going wrong
Multiple site owners report that security scanners flag this schema plugin for cross-site scripting and PHP object injection weaknesses. They ask for a patched release, and some say scanners recommend removing the plugin until a fix arrives. Owners of business and blog sites feel stuck between a flagged plugin and losing their rich results. The reports span from 2023 to 2026, which suggests that patches have not kept pace with disclosures. A vulnerability monitor that tells owners when their installed version is affected, and offers a managed patch or replacement, would fit these sites well.
AI-assisted: written with the help of AI from the reports.
Products affected
Structured Content (JSON-LD) #wpsc.
Related problems
Who has this problem
1 business found.
Unlock them at the top of this page — $19.
All sales are final — no refunds.
Each business's name, the address it published, and the page it was published on. Paid through Stripe; you get a private page to bookmark, with a CSV download.