Stored Cross-Site Scripting Vulnerability in AMP for WP Plugin by WordPress

CVE-2023-6782

What is CVE-2023-6782?

The AMP for WP – Accelerated Mobile Pages plugin is prone to a vulnerability allowing authenticated attackers with contributor-level or higher permissions to exploit insufficient input sanitization and output escaping. By injecting arbitrary web scripts into the plugin's shortcodes, attackers can cause these scripts to execute whenever a user accesses the impacted pages, potentially compromising user data and site integrity.

References