Security Alert Summary
The AMP Enhancer – Compatibility Layer for Official AMP Plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the AMP Custom CSS setting. Authenticated users with Administrator-level access and above can inject scripts that execute when an injected page is viewed. The issue affects multisite installations and sites where unfiltered_html is disabled.
CVE Details
- CVE ID:
CVE-2026-2027 - Affected component: AMP Enhancer – Compatibility Layer for Official AMP Plugin for WordPress
- Affected versions: All versions up to, and including, 1.0.49
- Published / Last modified: February 14, 2026 at 5:16 AM UTC (published); February 14, 2026 at 5:16 AM UTC (last modified)
- CVSS v3.1: Base Score 4.4 (MEDIUM) —
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N - Authentication / privileges / user interaction: Requires an authenticated attacker with Administrator-level access and above (description). CVSS details: Privileges Required = HIGH, User Interaction = NONE.
- Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
- CWE / weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting)
Technical Details
The vulnerability is a stored cross-site scripting (XSS) issue triggered via the AMP Custom CSS setting. According to the CVE description, insufficient input sanitization and output escaping on user-supplied attributes allows authenticated users with Administrator-level privileges to inject arbitrary web scripts into pages. These scripts execute whenever a user views an injected page.
The problem is associated with the plugin’s handling of custom AMP CSS input; references point to the admin file amp-enhancer-custom-css/amp-enhancer-custom-css.php, which is related to management of the AMP Custom CSS setting. The vulnerability specifically affects multisite installations and installations where unfiltered_html has been disabled.
Impact is limited to what stored XSS typically allows given the stated privileges: execution of attacker-supplied scripts in the context of affected pages. The CVE and CVSS data do not indicate elevation of privileges beyond Administrator nor indicate direct impact to availability.
How This Could Impact Your Website
Imagine a WordPress network (multisite) where a contractor or an internal staff member with Administrator-level access updates site styles via the AMP Custom CSS field. An attacker with equivalent privileges could insert a script that runs when editors or end users view certain pages. Practical consequences include session token exposure in some contexts, leakage of user-facing data on affected pages, and increased risk of targeted phishing or social engineering against site staff and users.
The described vulnerability requires Administrator-level privileges to exploit, so it does not enable anonymous attackers to inject content — however, the presence of injected script execution can still harm user trust and allow targeted attacks against site users and staff.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available. (The CVE notes affected versions up to and including 1.0.49; a fixed version is not specified in the CVE entry.)
- Review and reduce unnecessary user roles, especially users with Administrator-level access and Contributors who can manage content.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce attack surface.
- Monitor site activity and logs for unusual behavior, especially changes to theme or plugin settings and unexpected edits to CSS or page content.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://gist.github.com/indonumberone/b373b970da88e87a218aed58d92ccfb2
- https://plugins.trac.wordpress.org/browser/amp-enhancer/tags/1.0.49/admin/amp-enhancer-custom-css/amp-enhancer-custom-css.php#L13
- https://plugins.trac.wordpress.org/browser/amp-enhancer/trunk/admin/amp-enhancer-custom-css/amp-enhancer-custom-css.php#L13
- https://www.wordfence.com/threat-intel/vulnerabilities/id/14014260-e872-48d8-8788-f89dbeec2080?source=cve
