AMP for WP – Accelerated Mobile Pages, CVE-2026-0627
- CVE, Research URL
- Application
- Published on
- Jan 09, 2026
- Research Description
- The AMP for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file uploads in all versions up to, and including, 1.1.10. This is due to insufficient sanitization of SVG file content that only removes `<script>` tags while allowing other XSS vectors such as event handlers (onload, onerror, onmouseover), foreignObject elements, and SVG animation attributes. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts via malicious SVG file uploads that will execute whenever a user views the uploaded file.
- Affected versions
-
max 1.1.11.
- Status
-
vulnerable
| Previous vulnerability researches |
|---|
| XO Event Calendar (CVE-2026-0556) , Apr 16, 2026 |
| XO Event Calendar (92562c6c-94a4-427d-97dc-7f5ffddcb6d8) , Jun 07, 2024 |