Schema & Structured Data for WP & AMP Vulnerability – Authenticated (Contributor+) Stored Cross-Site Scripting via How To and FAQ Blocks – CVE-2024-3491 | WordPress Plugin Vulnerability Report

Plugin Name: Schema & Structured Data for WP & AMP

Key Information:

  • Software Type: Plugin
  • Software Slug: schema-and-structured-data-for-wp
  • Software Status: Active
  • Software Author: magazine3
  • Software Downloads: 5,175,623
  • Active Installs: 100,000
  • Last Updated: May 6, 2024
  • Patched Versions: 1.30
  • Affected Versions: <= 1.29

Vulnerability Details:

  • Name: Schema & Structured Data for WP & AMP <= 1.29
  • Title: Authenticated (Contributor+) Stored Cross-Site Scripting via How To and FAQ Blocks
  • Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
  • CVE: CVE-2024-3491
  • CVSS Score: 6.4
  • Publicly Published: April 22, 2024
  • Researcher: stealthcopter
  • Description: The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's "How To" and "FAQ" Blocks in all versions up to, and including, 1.29. This vulnerability stems from insufficient input sanitization and output escaping on user-supplied attributes. Authenticated attackers, with contributor-level access or higher, can inject arbitrary web scripts in pages that execute whenever a user accesses an injected page.


The Schema & Structured Data for WP & AMP for WordPress has a vulnerability in versions up to and including 1.29 that allows for stored cross-site scripting through specific content blocks. This vulnerability has been patched in version 1.30.

Detailed Overview:

The vulnerability discovered by researcher stealthcopter affects the "How To" and "FAQ" blocks of the plugin, where insufficient sanitization of input and inadequate escaping of output allows attackers to execute stored cross-site scripting (XSS). Attackers with at least contributor privileges can exploit this to deliver scripts that run when other users access the manipulated content. This vulnerability poses risks of data leakage, unauthorized actions on behalf of the user, and other malicious activities facilitated by XSS attacks. The immediate remedy is to update the plugin to the patched version.

Advice for Users:

  • Immediate Action: Update to version 1.30 immediately.
  • Check for Signs of Vulnerability: Review your site's pages, especially where "How To" and "FAQ" blocks are used, for unusual scripts or slow load times.
  • Alternate Plugins: While a patch is available, consider evaluating other similar plugins as a precaution.
  • Stay Updated: Regularly update all plugins to their latest versions to safeguard against vulnerabilities.


The quick response by the plugin developers to release a patched version highlights the critical importance of maintaining up-to-date software. Users should immediately upgrade to version 1.30 or later to protect their WordPress installations from potential exploits.


Detailed Report: 

In the fast-paced digital age, the security of your website is not just an operational detail, but a cornerstone of your business's integrity and trustworthiness. The recent discovery of a significant vulnerability in the widely-used WordPress plugin, "Schema & Structured Data for WP & AMP," serves as a potent reminder of this fact. Known as CVE-2024-3491, this flaw is a stark illustration of the ongoing battle between maintaining functionality and ensuring security. With this plugin installed on over 100,000 websites, the potential for damage is not trivial—highlighting why regular updates and vigilant security practices are not just advisable, they are essential.

Detailed Overview and Risks

This vulnerability arises from insufficient input sanitization and output escaping on user-supplied attributes within the "How To" and "FAQ" blocks. Authenticated users, particularly those with contributor-level access or higher, can exploit this to inject harmful scripts. These scripts could then execute whenever other users or site visitors interact with the affected pages. The risks include unauthorized data access, website defacement, and the potential for escalating privileges, which could lead to broader network compromise.

Historical Context and Repeated Vulnerabilities

This is not an isolated incident. Since December 27, 2023, there have been four other documented vulnerabilities within the same plugin. This pattern suggests a concerning trend in software security that demands attention and action.

Advice for Small Business Owners

As a small business owner, it might seem daunting to stay on top of every security detail when your focus is primarily on growing your business. However, neglecting this aspect can lead to serious repercussions, potentially undermining customer trust and financial stability. Consider leveraging managed WordPress hosting services that include security monitoring and updates, or engaging with professionals who can maintain the technical health of your digital assets. Such proactive measures can be a cost-effective way to protect your business in the long run.

Conclusion: The Imperative of Proactive Security Management

This latest vulnerability should be a wake-up call for all WordPress site owners. The ongoing security of your website is not just about fixing problems as they arise—it’s about preventing them before they impact your business. Staying informed and proactive in managing website security, with regular updates and timely interventions, is the best strategy to safeguard your site against threats. Remember, in the realm of cybersecurity, an ounce of prevention is worth a pound of cure.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

Schema & Structured Data for WP & AMP Vulnerability – Authenticated (Contributor+) Stored Cross-Site Scripting via How To and FAQ Blocks – CVE-2024-3491 | WordPress Plugin Vulnerability Report FAQs

What is CVE-2024-3491?

CVE-2024-3491 refers to a security vulnerability discovered in the WordPress plugin Schema & Structured Data for WP & AMP. This vulnerability is classified as stored cross-site scripting (XSS), which could allow attackers with contributor-level access or higher to inject malicious scripts into web pages.

The malicious scripts injected through the vulnerability can run when a user views the affected page. This can lead to unauthorized access to personal data, website defacement, or even further exploitation within the affected system. The impact of such vulnerabilities can be significant, prompting the necessity for immediate updates and security checks.

Leave a Comment