CVE-2026-97019

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headline-' Shortcode Attribute in all versions up to, and including, 1.1.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-97019 AMP for WP <= 1.1.17 - Unauthenticated Stored Cross-Site Scripting via 'headline-*' Shortcode Attribute

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headline-' Shortcode Attribute in all versions up to, and including, 1.1.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-97019 AMP for WP <= 1.1.17 - Unauthenticated Stored Cross-Site Scripting via 'headline-*' Shortcode Attribute

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headline-' Shortcode Attribute in all versions up to, and including, 1.1.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

EUVD-2026-111562

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headline-' Shortcode Attribute in all versions up to, and including, 1.1.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-97019

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) in versions up to and including 1.1.17 . The root cause is insufficient input sanitization and output escaping regarding the 'headline-*' Shortcode Attribute . Specifi...

PT-2026-127793

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headline-' Shortcode Attribute in all versions up to, and including, 1.1.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

Mohammed Kaludi AMP for WP cross-site scripting vulnerability

Mohammed Kaludi AMP for WP versions 1.1.17 and earlier contain a cross-site scripting vulnerability. This flaw arises from insufficient input sanitization and output escaping via the ‘headline-’ shortcode attribute. Unauthenticated attackers can inject arbitrary web scripts into pages, which are...

CVE-2026-97019: mohammed_kaludi AMP for WP – Accelerated Mobile Pages: The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headline-' Shortcode Attribute in all versions up to, and including, 1.1.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

WordPress AMP for WP – Accelerated Mobile Pages plugin <= 1.1.17 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by crow in WordPress Plugin AMP for WP versions = 1.1.17...

CrewAI AMP Suite Code Injection Vulnerability

The CrewAI AMP Suite has a code injection vulnerability. This vulnerability stems from the loadagentfromrepository function not properly restricting the parameters provided by the user before they are used to import modules. This could allow remote attackers to execute arbitrary code within the...

CrewAI AMP Suite server-side request forgeing vulnerability

CrewAI AMP Suite versions 1.15.28 and earlier have a server-side request forgeing vulnerability. This vulnerability stems from the fact that the SeleniumScrapingTool does not apply the validateurl private address checking, making it vulnerable to server-side request forgeing attacks. Attackers ca...

CVE-2026-96570

The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswpreviewtext' parameter in all versions up to, and including, 1.67 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...

CVE-2026-96570

The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.67 . The root cause is insufficient input sanitization and output escaping of the saswp_review_text parameter. This allows unauthenticated attack...

CVE-2026-96570 Schema & Structured Data for WP & AMP <= 1.67 - Unauthenticated Stored Cross-Site Scripting via 'saswp_review_text' Parameter

The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswpreviewtext' parameter in all versions up to, and including, 1.67 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...

CVE-2026-96570 Schema & Structured Data for WP & AMP <= 1.67 - Unauthenticated Stored Cross-Site Scripting via 'saswp_review_text' Parameter

The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswpreviewtext' parameter in all versions up to, and including, 1.67 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...

EUVD-2026-102657

The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswpreviewtext' parameter in all versions up to, and including, 1.67 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...

PT-2026-115466

The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswp review text' parameter in all versions up to, and including, 1.67 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-96570: Improper Neutralization of Input During Web Page Generation

The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswpreviewtext' parameter in all versions up to, and including, 1.67 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...

WordPress Schema & Structured Data for WP & AMP plugin <= 1.67 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by r3foxx in WordPress Plugin Schema & Structured Data for WP & AMP versions = 1.67...

WordPress Schema & Structured Data for WP & AMP Cross-site Script Vulnerabilities

WordPress Schema & Structured Data for WP & AMP 1.67 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient input sanitization and output escaping of the saswpreviewtext parameter. Additionally, the nonce field, which serves as the only...