PT-2026-1963 · WordPress · Wordpress+1

Andrea Bocchetti · Publicado 2026-01-09 · Atualizado 2026-01-09 · CVE-2026-0627

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions AMP for WP plugin for WordPress versions prior to 1.1.11

Description The AMP for WP plugin for WordPress is susceptible to Stored Cross-Site Scripting through SVG file uploads. Insufficient sanitization of SVG file content allows for the injection of malicious web scripts. Specifically, the sanitization process only removes <script> tags, while other XSS vectors, such as event handlers (onload, onerror, onmouseover), foreignObject elements, and SVG animation attributes, remain exploitable. Authenticated attackers with Author-level access or higher can upload malicious SVG files. These scripts execute whenever a user views the uploaded file.

Recommendations Update the AMP for WP plugin to version 1.1.11 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-0627

Produtos afetados

Amp For Wp

Wordpress

Referências · 8

• https://plugins.trac.wordpress.org/changeset/3434946/accelerated-mobile-pages/trunk/templates/features.php?old=3426181&old_path=accelerated-mobile-pages%2Ftrunk%2Ftemplates%2Ffeatures.php · Nota
• https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/tags/1.1.10/templates/features.php#L10373 · Nota
• https://twitter.com/VulmonFeeds/status/2009692680280850555 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/trunk/templates/features.php#L10373 · Nota
• https://t.me/CVEtracker/41805 · Publicação no Telegram
• https://wordfence.com/threat-intel/vulnerabilities/id/4ed23318-3b47-4336-a3aa-6b09f3911926?source=cve · Nota
• https://twitter.com/CVEnew/status/2009549383675899981 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-0627 · Nota de Segurança