CVE-2026-1575: Schema Shortcode Plugin XSS Vulnerability

CVE-2026-1575 Overview

CVE-2026-1575 is a stored Cross-Site Scripting (XSS) vulnerability in the Schema Shortcode plugin for WordPress. The flaw affects all versions up to and including 1.0. It exists in the plugin's itemscope shortcode, which fails to sanitize input and escape output on user-supplied attributes. Authenticated attackers with contributor-level access or higher can inject arbitrary JavaScript into pages. The injected payload executes in the browser of any user who views the affected page. The weakness is categorized under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Contributor-level accounts can persist JavaScript payloads that execute against site visitors and administrators, enabling session theft, forced administrative actions, and content defacement.

Affected Products

Schema Shortcode plugin for WordPress, all versions up to and including 1.0
WordPress sites permitting contributor-level user registration with the plugin installed
WordPress installations relying on the plugin's itemscope shortcode for schema markup

Discovery Timeline

2026-03-21 - CVE-2026-1575 published to NVD
2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-1575

Vulnerability Analysis

The Schema Shortcode plugin renders Schema.org microdata into WordPress posts and pages through shortcodes. The itemscope shortcode accepts attributes that are written directly into HTML output. The plugin neither sanitizes the incoming attribute values nor applies output escaping when rendering the final markup. An authenticated user with contributor permissions can therefore embed shortcode parameters containing JavaScript event handlers or script delimiters.

When a reviewer, editor, administrator, or site visitor loads the post containing the malicious shortcode, the browser parses the attacker-controlled markup and executes the script in the context of the site's origin. Because the payload is stored in the database, every subsequent page view triggers execution. The Scope is Changed in the CVSS vector, reflecting that script execution crosses the trust boundary from the contributor's authoring privileges to other users' browser sessions.

Root Cause

The root cause is missing input sanitization and missing output escaping on shortcode attribute values processed in the plugin's shortcode handler. The vulnerable code path is documented in the WordPress Plugin Code Review. WordPress provides helpers such as esc_attr(), esc_html(), and wp_kses() for this purpose, none of which are applied before rendering.

Attack Vector

An attacker first obtains contributor-level credentials, either through registration on sites that permit it or by compromising an existing low-privilege account. The attacker drafts a post that includes the itemscope shortcode with an attribute value containing a JavaScript payload, for example through an injected event handler attribute. When the post is previewed, published, or accessed, the stored script executes in the victim's browser. See the Wordfence Vulnerability Report for additional technical context.

// No verified proof-of-concept code is published.
// See the linked Wordfence advisory and plugin source for technical details.

Detection Methods for CVE-2026-1575

Indicators of Compromise

Post or page content containing itemscope shortcode attributes with <script> tags, javascript: URIs, or on* event handlers
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after viewing posts authored by contributors
New administrative users, modified user roles, or altered plugin and theme files following contributor activity

Detection Strategies

Query the wp_posts table for stored shortcode usage and review attribute contents for HTML or script delimiters
Inspect web server access logs for contributor accounts submitting posts with abnormally long or encoded shortcode parameters
Deploy a Web Application Firewall rule that flags shortcode attributes containing reflected XSS signatures

Monitoring Recommendations

Audit contributor and author account creations and password resets on WordPress sites running the Schema Shortcode plugin
Monitor browser-side errors and Content Security Policy violation reports from administrator sessions
Track plugin file integrity and database changes affecting wp_options, user roles, and post content

How to Mitigate CVE-2026-1575

Immediate Actions Required

Deactivate and remove the Schema Shortcode plugin until a patched release is published
Review all existing posts and pages for itemscope shortcode usage and remove suspicious attribute values
Restrict contributor registration and audit existing low-privilege accounts for unauthorized access

Patch Information

No patched version is identified in the available advisory data. The vulnerability affects all versions up to and including 1.0. Site operators should monitor the WordPress plugin repository and the Wordfence advisory for an updated release.

Workarounds

Remove the plugin and replace it with an actively maintained schema markup solution that applies WordPress escaping APIs
Enforce a strict Content Security Policy that blocks inline script execution to reduce XSS impact
Limit shortcode usage to higher-privilege roles by filtering do_shortcode calls or stripping the itemscope shortcode at render time

bash

# Temporarily disable the vulnerable plugin via WP-CLI
wp plugin deactivate schema-shortcode
wp plugin delete schema-shortcode

# Audit posts for itemscope shortcode usage
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%[itemscope%';"