CVE-2026-83591: AMP for WP <= 1.1.16 - Unauthenticated Stored Cross-Site Scripting via Comment Content Regex Transformation
The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Regex Transformation in all versions up to, and including, 1.1.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The crafted payload uses only WordPress-permitted comment tags and attributes (an anchor with href and title), and the AMP sanitizer pipeline omits javascript: protocol blocking, meaning neither the comment save filter nor the AMP output stage removes the malicious URI introduced by the transformation.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and what access do they need?
An unauthenticated attacker can exploit it by submitting crafted comment content. No prior account or authenticated WordPress access is required.
Which installations are affected?
AMP for WP – Accelerated Mobile Pages versions up to and including 1.1.16 are affected. The vulnerable behavior is in the AMP comment-processing pipeline.
What is required for the injected script to run?
A user must access a page containing the attacker’s injected comment. The payload can use WordPress-permitted comment markup, specifically an anchor tag with href and title attributes.
Why might normal comment filtering not stop the payload?
The issue relies on a regex transformation that introduces a malicious javascript: URI. The AMP sanitizer pipeline does not block that protocol, so neither the comment save filter nor AMP output processing removes it.