---
id: CVE-2026-83591
title: >-
  The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable
  to Stored Cross-Site Scripting via Comment Content via Regex Transformation in
  all versions up to, and including, 1.1.16 due to insufficient input
  sanitization …
summary: >-
  The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable
  to Stored Cross-Site Scripting via Comment Content via Regex Transformation in
  all versions up to, and including, 1.1.16 due to insufficient input
  sanitization …
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
vendor: mohammed_kaludi
product: AMP for WP – Accelerated Mobile Pages
affected:
  - amp_for_wp_accelerated_mobile_pages <= 1.1.16
published: '2026-09-25'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T13:08:26.930'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-83591'
references:
  - url: >-
      https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/tags/1.1.14/components/comments/comments.php#L89
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/tags/1.1.14/includes/features/functions.php#L314
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/tags/1.1.14/templates/features.php#L8823
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/tags/1.1.15/components/comments/comments.php#L89
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/tags/1.1.15/includes/features/functions.php#L314
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/tags/1.1.15/templates/features.php#L8823
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/changeset?reponame=&old=3689899%40accelerated-mobile-pages&new=3689899%40accelerated-mobile-pages
    label: security@wordfence.com
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/47ef0e19-8b67-42ad-b8e9-72b0dbe5e3a5?source=cve
    label: security@wordfence.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-25T07:01:12.113Z'
---

## Overview

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Regex Transformation in all versions up to, and including, 1.1.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The crafted payload uses only WordPress-permitted comment tags and attributes (an anchor with href and title), and the AMP sanitizer pipeline omits javascript: protocol blocking, meaning neither the comment save filter nor the AMP output stage removes the malicious URI introduced by the transformation.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.