PT-2026-1963 · WordPress · Wordpress+1

Andrea Bocchetti · Published 2026-01-09 · Updated 2026-01-09 · CVE-2026-0627

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions AMP for WP plugin for WordPress versions prior to 1.1.11

Description The AMP for WP plugin for WordPress is susceptible to Stored Cross-Site Scripting through SVG file uploads. Insufficient sanitization of SVG file content allows for the injection of malicious web scripts. Specifically, the sanitization process only removes <script> tags, while other XSS vectors, such as event handlers (onload, onerror, onmouseover), foreignObject elements, and SVG animation attributes, remain exploitable. Authenticated attackers with Author-level access or higher can upload malicious SVG files. These scripts execute whenever a user views the uploaded file.

Recommendations Update the AMP for WP plugin to version 1.1.11 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-0627

Affected Products

Amp For Wp

Wordpress

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-0627 · Security Note
• https://plugins.trac.wordpress.org/changeset/3434946/accelerated-mobile-pages/trunk/templates/features.php?old=3426181&old_path=accelerated-mobile-pages%2Ftrunk%2Ftemplates%2Ffeatures.php · Note
• https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/tags/1.1.10/templates/features.php#L10373 · Note
• https://twitter.com/VulmonFeeds/status/2009692680280850555 · Twitter Post
• https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/trunk/templates/features.php#L10373 · Note
• https://t.me/CVEtracker/41805 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/4ed23318-3b47-4336-a3aa-6b09f3911926?source=cve · Note
• https://twitter.com/CVEnew/status/2009549383675899981 · Twitter Post