CVE-2026-2027 Overview
CVE-2026-2027 is a stored Cross-Site Scripting (XSS) vulnerability in the AMP Enhancer – Compatibility Layer for Official AMP Plugin for WordPress. The flaw affects all versions up to and including 1.0.49. It stems from insufficient input sanitization and output escaping on user-supplied attributes processed by the AMP Custom CSS setting. Authenticated attackers with Administrator-level access can inject arbitrary web scripts that execute when users access an affected page. The issue only impacts WordPress multi-site installations and instances where the unfiltered_html capability has been disabled. The vulnerability is tracked under [CWE-79].
Critical Impact
Authenticated administrators on multi-site WordPress installations can store JavaScript payloads through the AMP Custom CSS setting that execute in the browser of any visitor to affected pages.
Affected Products
- AMP Enhancer – Compatibility Layer for Official AMP Plugin for WordPress (all versions through 1.0.49)
- WordPress multi-site installations running the plugin
- WordPress installations with unfiltered_html capability disabled
Discovery Timeline
- 2026-02-14 - CVE-2026-2027 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2026-2027
Vulnerability Analysis
The vulnerability resides in the AMP Custom CSS administrative feature exposed by the plugin. The plugin accepts user-supplied content intended to be rendered as CSS but fails to enforce sufficient input sanitization or output escaping on the supplied attributes. As a result, an authenticated attacker can submit a payload that breaks out of the CSS context and is reflected into rendered pages as executable script content.
Because the malicious payload is persisted in the WordPress database via plugin settings, every subsequent visitor to an affected page triggers script execution in their browser session. The plugin source can be reviewed in the WordPress Plugin CSS File where the unsafe handling occurs.
Root Cause
The root cause is missing or inadequate sanitization of stored input combined with missing output escaping when the AMP Custom CSS attribute is emitted into page output. WordPress mitigates this class of issue by restricting administrators with the unfiltered_html capability, but on multi-site installations that capability is removed by default. The plugin does not re-impose its own sanitization layer, leaving the injection vector accessible.
Attack Vector
Exploitation requires authenticated access at the Administrator role or higher. The attacker navigates to the AMP Custom CSS setting and submits a payload that bypasses the weak CSS-context handling. The payload is persisted to the plugin's configuration and later rendered into pages served to site users. When a visitor loads an affected page, the stored script executes in their browser, enabling session theft, account takeover of lower-privileged users, redirection, or further client-side attacks. A demonstration is published as a GitHub Gist PoC.
No verified exploitation code is included in this article. Refer to the public proof-of-concept for technical specifics.
Detection Methods for CVE-2026-2027
Indicators of Compromise
- Unexpected <script> tags, javascript: URIs, or HTML event handlers stored within AMP Enhancer Custom CSS settings in the WordPress options table.
- Outbound browser requests from site visitors to attacker-controlled domains shortly after loading pages that render the plugin's custom CSS.
- Administrator account modifications to AMP Enhancer settings from unfamiliar IP addresses or at unusual times.
Detection Strategies
- Review the wp_options table for plugin keys associated with amp-enhancer-custom-css and inspect stored values for non-CSS content such as <, >, onerror=, or </style> sequences.
- Inspect rendered page HTML for script content originating from the AMP Enhancer Custom CSS output block.
- Correlate WordPress administrative audit logs with changes to AMP Enhancer settings and subsequent visitor-side script execution alerts.
Monitoring Recommendations
- Enable a WordPress activity log plugin to capture administrator changes to plugin settings, including the AMP Custom CSS field.
- Monitor web server access logs for anomalous traffic to AMP-rendered pages that may indicate an injected payload calling out to remote endpoints.
- Deploy Content Security Policy (CSP) reporting to detect inline script execution that should not occur on plugin-rendered pages.
How to Mitigate CVE-2026-2027
Immediate Actions Required
- Update the AMP Enhancer plugin to a version later than 1.0.49 as soon as a patched release is published by the vendor.
- Audit AMP Custom CSS settings on all sites in any multi-site network and remove non-CSS content.
- Rotate credentials and session tokens for any Administrator accounts whose activity cannot be verified as legitimate.
- Review the Wordfence Vulnerability Analysis for advisory updates and detection rules.
Patch Information
At time of publication, the issue affects all versions of AMP Enhancer up to and including 1.0.49. Administrators should monitor the WordPress Plugin repository for a fixed release that introduces server-side sanitization and output escaping for the Custom CSS attribute.
Workarounds
- Restrict Administrator-level access to a minimal set of trusted accounts and enforce multi-factor authentication for all administrators.
- On multi-site installations where the patch cannot be applied immediately, temporarily deactivate the AMP Enhancer plugin or remove the Custom CSS configuration.
- Deploy a web application firewall rule that blocks HTML tags and JavaScript event handlers submitted to the AMP Enhancer settings endpoint.
- Enforce a strict Content Security Policy that disallows inline scripts on pages rendered by the plugin.
# Configuration example: WP-CLI command to deactivate the plugin pending a patch
wp plugin deactivate amp-enhancer --network
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
