The Structured Content plugin helps WordPress users enhance their pages with rich JSON-LD schema.org structured data elements. It allows for the insertion of components like FAQs, job postings, events, and more, with options to display the content as visible HTML or hidden machine-readable data.
However, in version 1.6.4 and below, a Stored Cross-Site Scripting (XSS) vulnerability was identified that allows users with Contributor privileges to inject malicious JavaScript via the “Additional CSS class(es)” field in FAQ blocks. This XSS payload is then persistently stored and can be executed when the HTML is rendered, leading to account compromise or further exploitation.
| CVE | CVE-2025-3414 |
| Structured Content (JSON-LD) | |
| Critical | High |
| All Time | 345 454 |
| Active installations | 50 000+ |
| Publicly Published | July 29, 2025 |
| Last Updated | July 29, 2025 |
| Researcher | Artyom Krugov |
| OWASP TOP-10 | A7: Cross-Site Scripting (XSS) |
| PoC | Yes |
| Exploit | No |
| Reference | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-3414 https://wpscan.com/vulnerability/1dd322b5-3c1d-4da7-8737-e6688fc9f4df/ |
| Plugin Security Certification by CleanTalk |  |
| Logo of the plugin |  |
PSC by CleantalkJoin the community of developers who prioritize security. Highlight your plugin in the WordPress catalog.
Timeline
| April 6, 2024 | Plugin testing and vulnerability detection in the Structured Content have been completed |
| April 6, 2024 | I contacted the author of the plugin and provided a vulnerability PoC with a description and recommendations for fixing |
| July 29, 2025 | Registered CVE-2025-3414 |
Discovery of the Vulnerability
During testing of the plugin, it was found that the “Additional CSS class(es)” field in the FAQ block allows arbitrary input without proper sanitization. This field is rendered directly into the class attribute of an HTML element on the frontend, which opens the door to attribute injection and ultimately stored XSS.
Vulnerable Plugin:
- Plugin Name: Structured Content
- Affected Versions: ≤ 1.6.4
- Vulnerable Field: Additional CSS class(es)
- Affected Block: FAQ Block (
sc_fs_faq)
Understanding of XSS attack’s
Stored XSS (Cross-Site Scripting) is a vulnerability that occurs when untrusted user input is stored on the server and later rendered into a webpage without proper sanitization or escaping. Unlike reflected XSS, stored XSS does not require tricking the victim into clicking a special URL — the payload is persistent and activates whenever the relevant page is loaded.
Why it’s critical in WordPress:
- WordPress is inherently multi-user.
- Plugins often store and display user-generated content.
- Admins may unknowingly trigger payloads injected by contributors.
Real-world examples of vulnerable plugin fields:
- Bio fields in user profiles
- Custom input fields in forms
- Meta boxes in post editors
- Shortcodes that process attributes or inner content
In this case, the popup text of the marker is rendered without escaping, directly inserting the malicious content into the DOM
Exploiting the XSS Vulnerability
To exploit CVE-2025-6572, an attacker with contributor+ privileges:
POC:
1) Log in as a user with the Contributor role. 2) Create a new post. 3) Insert a Structured Content > FAQ block. 4) In the “Additional CSS class(es)” field of the FAQ Item, insert the payload: 123" onmouseover='alert(777)' 5) Save or submit the post for review. 6) When an admin or visitor views the post and hovers over the element, the script executes.____
Why this works:
The plugin fails to:
- Sanitize user input in the class field.
- Escape HTML attribute output when rendering.
This leads to arbitrary attribute injection and allows event handlers like onmouseover or onclick to be added.
Recommendations for Improved Security
For Plugin Developers:
- Sanitize All User Input: Use
sanitize_html_class()or similar WordPress functions for fields used in class attributes. - Escape on Output: Always apply
esc_attr()when outputting into HTML attributes. - Harden the Editor Integration: Prevent Contributor-level users from accessing fields that can be used for code injection unless input is strictly validated.
- Audit Shortcodes and Blocks: Ensure all dynamic content rendering is properly sanitized and escaped.
For Site Administrators:
- Update the Plugin: If a fix becomes available, update to the latest patched version.
- Use a WAF: Web Application Firewalls (e.g., Cloudflare, Wordfence) can help block malicious scripts from executing.
- Restrict Contributor Roles: Don’t allow Contributor content to be published without manual review.
- Perform Security Audits: Regularly scan site content and post metadata for potential XSS payloads.
- Educate Content Managers: Train editors and admins to recognize unusual content and suspicious code in posts.
To prevent this type of attacks vendor used our methods of prevention.
By taking proactive measures to address Stored XSS vulnerabilities like CVE-2025-3414 WordPress website owners can enhance their security posture and safeguard against potential exploitation. Stay vigilant, stay secure.
#WordPressSecurity #StoredXSS #WebsiteSafety #StayProtected #Vulnerability
Use CleanTalk solutions to improve the security of your website
Artyom k.