CVE-2026-83591

Name of the Vulnerable Software and Affected Versions AMP for WP versions prior to 1.1.17

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS) via comment content. The issue occurs during Regex Transformation, where the AMP sanitizer pipeline fails to block the javascript: protocol. Attackers can inject arbitrary web scripts using WordPress-permitted comment tags and attributes, such as an anchor with href and title attributes, which execute when a user accesses the affected page.

Recommendations Update AMP for WP to a version later than 1.1.16.