Stored Cross-Site Scripting Vulnerability in AMP for WP Plugin by WordPress

CVE-2026-97019

What is CVE-2026-97019?

The AMP for WP – Accelerated Mobile Pages plugin presents a serious vulnerability due to inadequate input sanitization and output escaping, allowing attackers to exploit the 'headline-*' Shortcode Attribute. This weakness enables unauthenticated users, such as subscribers, to inject arbitrary web scripts into pages. When users access these compromised pages, malicious scripts execute, which can result in various harmful actions. The vulnerability arises from the fact that WordPress core's wp_filter_kses() function only removes HTML tags without addressing shortcode syntax. Consequently, any AMP content sanitizers are ineffective as they process content prior to executing shortcode commands, leaving the synthesized markup vulnerable and unsanitized.

References