{"id":"CVE-2026-97019","kind":"vulnerability","aliases":["CVE-2026-97019"],"related":[],"title":"AMP for WP plugin: stored XSS via headline shortcode attribute","description":"The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headline-*' Shortcode Attribute in all versions up to, and including, 1.1.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A Subscriber-level user can store a malicious shortcode in their biographical info field; because WordPress core's wp_filter_kses() only strips HTML tags and not shortcode syntax, and because AMP content sanitizers run before do_shortcode() processes the archive description, the synthesized markup is never post-sanitized.","summary":"The AMP for WP plugin for WordPress up to and including 1.1.17 fails to sanitize the 'headline-*' shortcode attribute, so injected script is stored and runs in the browser of anyone who opens the affected page. A Subscriber-level user can plant the payload through their biographical info field, and the description says unauthenticated attackers can inject it as well.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugins"],"not_affected_if":["plugin-not-installed","plugin-updated"],"how_to_check":"- Check the installed plugin version in the WordPress admin Plugins list or with `wp plugin get amp --field=version` and see whether it is `1.1.17` or older.\n- Search post and page content for `[headline` shortcode usage and review the attribute values.\n- unknown for further checks in the sources.","fix":"- Update the AMP for WP plugin to a version newer than `1.1.17` (the sources do not name the fixed release).\n- Until patched, disable the plugin or remove unneeded `headline-*` shortcodes from content.","status":"open","published_at":"2026-10-28T03:17:16+00:00","first_seen_at":"2026-10-28T03:31:02+00:00","triaged_at":"2026-10-28T03:32:31+00:00","updated_at":"2026-10-28T03:32:31+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T03:32:31Z","model":"claude-haiku-5-5","output":{"fix":"- Update the AMP for WP plugin to a version newer than `1.1.17` (the sources do not name the fixed release).\n- Until patched, disable the plugin or remove unneeded `headline-*` shortcodes from content.","reach":"internet","title":"AMP for WP plugin: stored XSS via headline shortcode attribute","impact":"medium","summary":"The AMP for WP plugin for WordPress up to and including 1.1.17 fails to sanitize the 'headline-*' shortcode attribute, so injected script is stored and runs in the browser of anyone who opens the affected page. A Subscriber-level user can plant the payload through their biographical info field, and the description says unauthenticated attackers can inject it as well.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugins","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker script runs in visitors' browsers, hijacking sessions or admin accounts.","analyst_note":"Confirm the fixed plugin version and whether unauthenticated exploitation is possible; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-97019 and the plugin's changelog.","how_to_check":"- Check the installed plugin version in the WordPress admin Plugins list or with `wp plugin get amp --field=version` and see whether it is `1.1.17` or older.\n- Search post and page content for `[headline` shortcode usage and review the attribute values.\n- unknown for further checks in the sources.","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-updated"],"who_is_affected":"Sites running the AMP for WP plugin at version 1.1.17 or older that render shortcodes in pages or in author biographical info. Sites that do not run this plugin are not affected. The sources do not say whether managed WordPress hosts apply mitigations.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000699,"input_tokens":3480,"output_tokens":701,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-97019':13A,16A '1.1.17':36B,115C 'acceler':90C 'access':144C 'affect':59B 'amp':1A,26B,87C,180C 'anyon':55B 'arbitrari':133C 'archiv':189C 'attack':80B,130C 'attribut':10A,43B,107C 'biograph':72B,160C 'browser':53B 'content':181C 'core':165C 'cross':101C 'cross-sit':100C 'cve':11A,14A 'descript':77B,190C 'due':116C 'escap':123C 'execut':140C 'fail':37B 'field':74B,162C 'filter':168C 'headlin':8A,41B,105C 'host':20B 'html':172C 'includ':35B,114C 'info':73B,161C 'inject':45B,82B,132C,146C 'input':119C 'insuffici':118C 'kses':169C 'level':64B,151C 'make':125C 'malici':156C 'markup':193C 'mobil':91C 'never':195C 'open':57B 'output':122C 'packag':17B 'page':60B,92C,137C,147C 'payload':69B 'plant':67B 'plugin':4A,24B,29B,93C 'possibl':127C 'post':197C 'post-sanit':196C 'process':187C 'run':50B,183C 'sanit':39B,120C,182C,198C 'say':78B 'script':46B,103C,135C 'self':19B 'self-host':18B 'shortcod':9A,42B,106C,157C,176C,186C 'site':102C 'store':5A,48B,99C,154C 'strip':171C 'subscrib':63B,150C 'subscriber-level':62B,149C 'syntax':177C 'synthes':192C 'tag':173C 'unauthent':79B,129C 'user':65B,143C,152C 'version':110C 'via':7A,104C 'vulner':97C 'web':134C 'well':85B 'whenev':141C 'wordpress':21B,23B,31B,95C,164C 'wordpress-plugin':22B 'wp':3A,28B,89C,167C 'xss':6A","nicknames":[],"mitigations":[],"who_affected":"Sites running the AMP for WP plugin at version 1.1.17 or older that render shortcodes in pages or in author biographical info. Sites that do not run this plugin are not affected. The sources do not say whether managed WordPress hosts apply mitigations.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T03:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97019","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97019","severity":null,"published_at":"2026-10-28T03:17:16+00:00","modified_at":"2026-10-28T03:17:16+00:00","first_seen_at":"2026-10-28T03:31:02+00:00","fetched_at":"2026-10-28T03:31:02+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}