CVE-2026-97019: stored XSS — HIGH

CISO Take

AMP for WP (Accelerated Mobile Pages) for WordPress, through version 1.1.17, has a stored cross-site scripting flaw. The 'headline-*' shortcode attribute is not sanitized or escaped, so an attacker can plant script that runs in every visitor's browser. This is a general WordPress plugin issue and not an AI/ML component. The 'ml_library' category assigned to it looks like a misclassification, and it matters only if the plugin runs on a site that fronts or documents your AI products. The CVSS score is 7.2 (High) with a changed scope. Exploitation looks easy: a low-privileged Subscriber can store the payload in a biographical info field. There is no CISA KEV listing, no public exploit, no Nuclei template and no EPSS data, so there is no sign of active exploitation. Update to the fixed release once the vendor publishes one, or deactivate the plugin until then. Review user bio fields for shortcode syntax.

Sources:NVDATLASwordfence.complugins.trac.wordpress.org

What is the risk?

Medium-to-high for affected WordPress sites, low for AI/ML risk. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C) rates it High at 7.2, but the description says a Subscriber account is needed to store the payload, so real-world privilege requirements are higher than the vector implies. On sites with open registration this is effectively trivial. There is no KEV listing, public exploit, scanner template or EPSS data. Impact is limited to low confidentiality and integrity loss, with scope change into visitors' browsers. Exposure depends on whether the plugin is installed and AMP archive pages are public.

How does the attack unfold?

Initial Access

Attacker registers or uses a Subscriber account and stores a malicious shortcode in the biographical info field.

AML.T0049

Exploitation

The AMP archive description is rendered; shortcode processing generates unsanitized markup containing attacker script.

Impact

Script runs in visitors' or administrators' browsers, enabling session theft, redirects or page defacement.

Initial Access

Attacker registers or uses a Subscriber account and stores a malicious shortcode in the biographical info field.

AML.T0049

Exploitation

The AMP archive description is rendered; shortcode processing generates unsanitized markup containing attacker script.

Impact

Script runs in visitors' or administrators' browsers, enabling session theft, redirects or page defacement.

How severe is it?

CVSS 3.1

7.2 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 15% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SChanged

CLow

ILow

ANone

What should I do?

1 step

1) Check whether AMP for WP (accelerated-mobile-pages) is installed and confirm the version. 2) Upgrade to a version later than 1.1.17 as soon as the vendor releases a fix, and review the referenced changeset. 3) If no fix is available, deactivate the plugin or disable AMP archive output. 4) Disable open user registration, or restrict new accounts to a non-Subscriber workflow, until patched. 5) Audit user biographical info fields and archive descriptions for shortcode syntax such as '[...headline-...=...]' and for script content. 6) Deploy a WAF rule and a strict Content-Security-Policy to limit inline script execution. 7) Monitor for unexpected new Subscriber registrations and profile edits.

How is it classified?

Code ExecutionPluginAML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2026-97019?

AMP for WP (Accelerated Mobile Pages) for WordPress, through version 1.1.17, has a stored cross-site scripting flaw. The 'headline-*' shortcode attribute is not sanitized or escaped, so an attacker can plant script that runs in every visitor's browser. This is a general WordPress plugin issue and not an AI/ML component. The 'ml_library' category assigned to it looks like a misclassification, and it matters only if the plugin runs on a site that fronts or documents your AI products. The CVSS score is 7.2 (High) with a changed scope. Exploitation looks easy: a low-privileged Subscriber can store the payload in a biographical info field. There is no CISA KEV listing, no public exploit, no Nuclei template and no EPSS data, so there is no sign of active exploitation. Update to the fixed release once the vendor publishes one, or deactivate the plugin until then. Review user bio fields for shortcode syntax.

Is CVE-2026-97019 actively exploited?

No confirmed active exploitation of CVE-2026-97019 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-97019?

1) Check whether AMP for WP (accelerated-mobile-pages) is installed and confirm the version. 2) Upgrade to a version later than 1.1.17 as soon as the vendor releases a fix, and review the referenced changeset. 3) If no fix is available, deactivate the plugin or disable AMP archive output. 4) Disable open user registration, or restrict new accounts to a non-Subscriber workflow, until patched. 5) Audit user biographical info fields and archive descriptions for shortcode syntax such as '[...headline-...=...]' and for script content. 6) Deploy a WAF rule and a strict Content-Security-Policy to limit inline script execution. 7) Monitor for unexpected new Subscriber registrations and profile edits.

What systems are affected by CVE-2026-97019?

This vulnerability affects the following AI/ML architecture patterns: WordPress websites, Public marketing and documentation sites.

What is the CVSS score for CVE-2026-97019?

CVE-2026-97019 has a CVSS v3.1 base score of 7.2 (HIGH). The EPSS exploitation probability is 0.24%.

What is the AI security impact?

Affected AI Architectures

WordPress websitesPublic marketing and documentation sites

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

What are the technical details?

Original Advisory

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headline-*' Shortcode Attribute in all versions up to, and including, 1.1.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A Subscriber-level user can store a malicious shortcode in their biographical info field; because WordPress core's wp_filter_kses() only strips HTML tags and not shortcode syntax, and because AMP content sanitizers run before do_shortcode() processes the archive description, the synthesized markup is never post-sanitized.

Exploitation Scenario

An attacker registers a Subscriber account on a WordPress site that runs AMP for WP and publishes content about an AI product. They store a crafted shortcode with a malicious 'headline-*' attribute in their biographical info field. Because core wp_filter_kses() does not strip shortcode syntax and the AMP sanitizers run before do_shortcode(), the generated markup reaches the author archive page unsanitized. When an administrator or customer opens that archive page, the script runs in their browser. It can steal session cookies, perform actions as the admin, or redirect visitors to a phishing page.

Weaknesses (CWE)

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Primary CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
[Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca

Source: MITRE CWE corpus.