Description

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Regex Transformation in all versions up to, and including, 1.1.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The crafted payload uses only WordPress-permitted comment tags and attributes (an anchor with href and title), and the AMP sanitizer pipeline omits javascript: protocol blocking, meaning neither the comment save filter nor the AMP output stage removes the malicious URI introduced by the transformation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-25T07:16:54.747Z",
  "pubdate": "2026-09-25T07:16:54.747Z",
  "executiveSummary": "The AMP for WP – Accelerated Mobile Pages plugin for WordPress, in versions up to and including 1.1.16, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. This security flaw originates from inadequate input sanitization and output escaping within the plugin's regex transformation process for comment content.\nThe vulnerability allows unauthenticated attackers to inject malicious web scripts into comment sections, which are subsequently rendered in the context of the victim's browser when accessing the affected pages. Because the plugin's AMP sanitizer pipeline fails to implement protocol-level blocking for 'javascript:' URIs, the injected payloads bypass existing security filters.\nThis vulnerability poses a significant risk to the integrity and confidentiality of user sessions. Successful exploitation allows for the execution of arbitrary JavaScript, potentially leading to unauthorized actions, session hijacking, or the distribution of malicious content to authenticated administrators and end-users. Given that the attack requires no authentication, it can be exploited remotely by any actor capable of posting comments on a WordPress site utilizing the vulnerable version of this plugin.",
  "technicalDetails": "The root cause of this vulnerability lies in a flawed regex-based transformation logic applied to comment content within the AMP for WP plugin. While WordPress typically imposes restrictions on HTML tags and attributes allowed within comments, the plugin's specific transformation pipeline performs additional processing that is insufficiently secured against script injection.\nThe attack flow begins with an unauthenticated attacker crafting a malicious payload utilizing standard WordPress-permitted comment elements, such as an anchor tag (<a>). By specifically crafting the 'href' attribute with a 'javascript:' protocol URI, the attacker circumvents standard comment filtering mechanisms.\nDuring the processing phase, the plugin's regex transformation mechanism fails to validate the protocol scheme of the URI. Furthermore, the AMP sanitizer pipeline, which is intended to scrub potentially dangerous content from the rendered AMP page, omits the necessary verification to block the 'javascript:' protocol. Consequently, the malicious URI is preserved through the sanitization stage and stored within the database.\nWhen a user subsequently views the affected page, the malicious script is rendered by the browser within the context of the site's origin. Because the script is executed whenever a user accesses the page, the impact is broad. If an administrator views the comment, the script could perform actions with elevated privileges, such as creating new administrative accounts, modifying site settings, or exfiltrating sensitive cookies.\nThe vulnerability affects all versions of the AMP for WP – Accelerated Mobile Pages plugin up to 1.1.16. Exploitation does not require authentication or specific privileges, as it targets the comment submission vector, which is typically open to the public by default in standard WordPress configurations. The lack of validation at both the input (comment save filter) and output (AMP transformation stage) ensures that the malicious payload remains persistent and executable.\nThis vulnerability highlights a critical failure in the defense-in-depth strategy where regex-based sanitization is used as a primary security control without robust URI protocol allowlisting. The inability of the AMP output stage to rectify the malformed content introduced earlier in the lifecycle renders the entire transformation chain ineffective against this specific XSS vector."
}