CVE-2025-0512: 
WordPress vulnerability analysis and mitigation

The Structured Content (JSON-LD) WordPress plugin versions up to 1.6.2 contains an authenticated Stored Cross-Site Scripting vulnerability identified as CVE-2025-0512. The vulnerability was discovered on March 3, 2025, and affects users with Contributor level access or higher (Wordfence Intel).

The vulnerability exists in the Classic Editor Shortcodes functionality of the Structured Content plugin. It allows authenticated users with contributor-level access or higher to inject malicious scripts that can be stored and executed when other users view the affected content (WordPress Plugin).

When exploited, this vulnerability could allow attackers to execute arbitrary JavaScript code in the context of other users' browsers who view the compromised content, potentially leading to session hijacking, credential theft, or other client-side attacks (Wordfence Intel).

The vulnerability requires an authenticated user account with at least Contributor-level permissions to exploit, making it somewhat limited in scope but still significant for sites that allow multiple users to create or edit content (WordPress Plugin).

The vulnerability has been patched in version 1.6.4 of the Structured Content plugin. Site administrators are strongly advised to update to the latest version immediately to protect against this security risk (WordPress Plugin).