CVE-2026-2027: AMP Enhancer WordPress Plugin XSS Flaw

CVE-2026-2027 Overview

The AMP Enhancer – Compatibility Layer for Official AMP Plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in the AMP Custom CSS setting. All versions up to and including 1.0.49 are affected due to insufficient input sanitization and output escaping on user-supplied attributes. This vulnerability enables authenticated attackers with Administrator-level access and above to inject arbitrary web scripts into pages that execute whenever a user accesses an injected page.

Critical Impact

Authenticated attackers can inject persistent malicious scripts that execute in the context of other users' sessions, potentially leading to session hijacking, administrative account compromise, and further exploitation of WordPress multi-site installations.

Affected Products

• AMP Enhancer – Compatibility Layer for Official AMP Plugin for WordPress versions up to and including 1.0.49
• WordPress multi-site installations with the affected plugin
• WordPress installations where unfiltered_html capability has been disabled

Discovery Timeline

• 2026-02-14 - CVE CVE-2026-2027 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2026-2027

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability (CWE-79) exists in the AMP Custom CSS functionality of the AMP Enhancer plugin. The vulnerability arises from the plugin's failure to properly sanitize and escape user-supplied CSS input before storing it in the database and rendering it on the front end. When an administrator configures custom CSS through the plugin's settings interface, malicious JavaScript can be embedded within CSS constructs that bypass insufficient validation controls.

The attack requires administrator-level privileges, which limits the initial attack surface. However, in WordPress multi-site environments or installations where unfiltered_html has been explicitly disabled, this vulnerability provides a pathway for privilege abuse. An attacker who has compromised an administrator account or operates as a rogue administrator can persist malicious scripts that affect all site visitors.

Root Cause

The root cause of this vulnerability lies in the amp-enhancer-custom-css.php file, specifically in how the plugin handles user-supplied CSS content. The vulnerable code path at line 13 of the affected file fails to implement proper input sanitization using WordPress security functions such as wp_kses() or esc_attr(). Additionally, the output escaping mechanisms are inadequate, allowing stored malicious content to be rendered as executable script when pages are loaded.

Attack Vector

The attack is delivered over the network and requires high-privilege authentication (Administrator role). An attacker must have valid administrative credentials to access the AMP Custom CSS settings panel. Once authenticated, the attacker injects malicious JavaScript within the CSS input field. The malicious payload is stored persistently in the WordPress database and executes in the browsers of any user who subsequently visits a page where the injected CSS is rendered.

The attack complexity is considered high because it specifically impacts multi-site installations or configurations where unfiltered_html has been disabled—scenarios where administrators would typically expect protection against such script injection.

The vulnerability mechanism involves inadequate sanitization of CSS input fields. When custom CSS containing malicious script tags or JavaScript event handlers is submitted through the admin interface, the plugin stores this content without proper sanitization. Upon page rendering, the unsanitized content is output to the browser, causing script execution. For detailed technical analysis, refer to the Wordfence Vulnerability Analysis and the vulnerable source code in the WordPress plugin repository.

Detection Methods for CVE-2026-2027

Indicators of Compromise

• Unexpected JavaScript code or event handlers present in AMP Custom CSS configuration fields
• Anomalous script execution warnings in browser developer consoles when viewing AMP pages
• Unauthorized modifications to the amp-enhancer plugin settings in the WordPress database
• Evidence of stored XSS payloads such as <script>, onerror=, or onload= in CSS-related database entries

Detection Strategies

• Review WordPress audit logs for unauthorized changes to AMP Enhancer Custom CSS settings
• Implement Content Security Policy (CSP) headers to detect and block inline script execution attempts
• Deploy web application firewall (WAF) rules to detect XSS payloads in POST requests to plugin settings endpoints
• Scan the WordPress database for suspicious content in options tables related to amp-enhancer

Monitoring Recommendations

• Enable WordPress activity logging plugins to track all administrative configuration changes
• Monitor for unusual patterns of administrator login activity that may indicate compromised credentials
• Configure SentinelOne Singularity to detect suspicious browser-based script execution patterns
• Implement real-time alerting for modifications to WordPress plugin settings

How to Mitigate CVE-2026-2027

Immediate Actions Required

• Update the AMP Enhancer plugin to a patched version when available from the developer
• Audit all administrator accounts for unauthorized access or suspicious activity
• Review and sanitize existing AMP Custom CSS configurations for malicious content
• Consider temporarily disabling the AMP Enhancer plugin until a patch is released
• Implement strict Content Security Policy headers to mitigate XSS impact

Patch Information

As of the last NVD update on 2026-02-18, administrators should monitor the WordPress plugin repository for an updated version of AMP Enhancer that addresses this vulnerability. The vulnerable code is located in admin/amp-enhancer-custom-css/amp-enhancer-custom-css.php. For additional technical details and patch status, consult the Wordfence Vulnerability Analysis and the WordPress Plugin Trac repository.

Workarounds

• Restrict administrator account access to only trusted personnel until the vulnerability is patched
• Disable the AMP Custom CSS feature if it is not critical to site functionality
• Implement additional server-side input validation for CSS content before storage
• Deploy a web application firewall with XSS detection rules targeting the plugin's settings endpoints

# Configuration example: Add Content Security Policy header in .htaccess
# This helps mitigate XSS impact by restricting inline script execution

Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline';"

# Review WordPress options for suspicious AMP Enhancer CSS content
# Run this WP-CLI command to inspect stored CSS values
wp option get amp_enhancer_custom_css --format=json