Stored XSS in AMP for WP WordPress Plugin

The AMP for WP - Accelerated Mobile Pages plugin for WordPress, in all versions up to and including 1.1.16, contains a stored Cross-Site Scripting (XSS) vulnerability. The issue stems from inadequate input sanitization and output escaping when processing comment content. Specifically, the plugin uses a regex transformation pipeline that fails to filter the 'javascript:' protocol within anchor tag attributes. Because the AMP sanitizer pipeline permits anchor tags with 'href' and 'title' attributes - which are considered legitimate by standard WordPress comment filters - the malicious payload bypasses intended security controls. An unauthenticated attacker can submit a crafted comment containing a JavaScript-based URI, which is then stored and executed in the context of any user visiting the compromised page. This represents a significant risk for session hijacking, credential theft, or unauthorized actions performed on behalf of legitimate users.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of a user's session. This can lead to full account compromise if the victim is an administrator, modification of page content, or redirection to malicious sites. The vulnerability affects all WordPress instances using the AMP for WP plugin up to version 1.1.16.

Recommendation

Prioritize the immediate update of the AMP for WP - Accelerated Mobile Pages plugin to a version addressing this flaw. In the absence of an available patch, consider disabling comment functionality on AMP-enabled pages or implementing a Web Application Firewall (WAF) rule to block common XSS patterns including 'javascript:' pseudo-protocols in user-supplied content. Detection engineers should monitor web server logs for HTTP POST requests directed at comment submission endpoints that contain suspicious anchor tag attributes or URI schemes.