AMP for WP - Accelerated Mobile Pages: Stored Cross-Site Scripting (CVE-2026-97019)
The AMP for WP - Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headline-*' shortcode attributes due to insufficient input sanitization and output escaping.
CVE search metadata
CVE search record: CVE-2026-97019. Severity: high. CVSS: 7.2. KEV: no. Product: AMP for WP – Accelerated Mobile Pages (<= 1.1.17). Brief: AMP for WP - Accelerated Mobile Pages: Stored Cross-Site Scripting (CVE-2026-97019). Brief link: https://feed.craftedsignal.io/briefs/2026-10-amp-wp-xss/
Triage facts
Revision 1- Applicability
- AMP for WP – Accelerated Mobile Pages (<= 1.1.17)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Oct 28, 08:26 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
The AMP for WP - Accelerated Mobile Pages plugin for WordPress, in all versions up to and including 1.1.17, contains a Stored Cross-Site Scripting vulnerability. The issue arises from insufficient input sanitization and output escaping within 'headline-*' shortcode attributes. A Subscriber-level user can store a malicious shortcode in their biographical info field, which executes when a user accesses the injected page. Unauthenticated attackers may also inject arbitrary web scripts into pages.