Schema Scalpel
Schema Scalpel has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Schema Scalpel has a vendor fix available, so running the current release closes it.
All of these findings were reported by Peter Thaleikis. Schema Scalpel is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2025-12118Schema Scalpel <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title in JSON-LD Schema
Read the full analysisVulnerability Records

Schema Scalpel
Author
Kevin Gillispie
Schema Scalpel 2.0 delivers surgical precision to your WordPress structured data. The headline feature: a brand-new metabox right inside the post/page editor (Gutenberg and Classic), letting you create, edit, and manage custom JSON-LD schemas without ever leaving the content screen. No bloated page builders or separate dashboards for everyday use — just fast, intuitive schema editing where you already work, with real-time AJAX saves and a modern, clean interface. Core Benefits & Features New in 2.0: Powerful Editor Metabox — Add/edit/delete per-post/page schemas directly in the editor. Real-time saving, syntax-highlighted JSON editor, visual separation of local vs global schemas. Examples Library — One-click copy of Google-recommended templates (FAQPage, Article, HowTo, Recipe, Product, Organization, Breadcrumb, and more). Per-Page Precision — Override or supplement global schemas for ultimate control — ideal for blogs, eCommerce, local businesses, and agencies. Global & Homepage Schemas — Still fully supported via the dedicated Schema Scalpel dashboard. Improved Security — Hardened against XSS (titles, URLs, breadcrumbs fully sanitized), secure JSON encoding, strict input validation — building on previous critical fixes. Compatibility — Works flawlessly alongside Yoast SEO, Rank Math, and All in One SEO. Easily disable their schema output to avoid duplication. Lightweight & Performant — Pure JSON-LD injection, no frontend bloat, optimized database storage. Safe Uninstall — Optional setting to clean up data on deletion — respect privacy and keep your site secure. Modern Codebase — Strict typing, full WordPress Coding Standards compliance, PHP 7.4+ compatibility. Whether you’re chasing rich results (stars, carousels, FAQs), improving entity understanding, or just giving search engines cleaner data — Schema Scalpel makes it effortless and reliable. Install today and start enhancing click-through rates and visibility!
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C