AMP for WP CVE-2026-97019

The concrete vector described requires a Subscriber-level account on the target WordPress site, used to inject a malicious shortcode into the user's biographical info field; the payload then executes when any user accesses the rendered AMP author archive page (no victim action beyond viewing). Exploitation depends on the AMP for WP plugin being active (version ≤1.1.17) and the AMP archive/author pages being served, and relies on the sanitizer ordering flaw where AMP content sanitizers run before do_shortcode() so synthesized markup is never post-sanitized. Limiting factor: the described path needs authenticated low-privilege (Subscriber) access and open user registration; the title also references an unauthenticated 'headline-*' shortcode-attribute path, but the available sources do not describe that trigger in detail.

This is a moderate-priority issue rather than an emergency. The input carries a 7.2 CVSS (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) and a vuln.today decision label of 'this_week', which together argue for prompt but not immediate remediation. It is NOT in CISA KEV and no EPSS score is supplied, so there is no signal of active or probable widespread exploitation - no public exploit identified at time of analysis (the references are the Wordfence advisory and WordPress.org source/changeset links, not a working exploit). The strongest internal conflict is in the privilege signal: the CVSS vector asserts PR:N (unauthenticated), but the described mechanism explicitly requires 'A Subscriber-level user' to store a payload in their biographical info field, which is authenticated low-privilege access - verify with the vendor which vector (unauthenticated 'headline-*' shortcode attribute vs. authenticated Subscriber bio) actually yields PR:N. As a stored XSS with scope change (S:C) and only Low confidentiality/integrity impact, real-world impact is session/content manipulation in victims' browsers, not direct server compromise. Net: treat as a this-week patch item given the low barrier if the unauthenticated vector holds, but it is not a drop-everything critical flaw.

An attacker registers (or abuses) a Subscriber-level account and stores a malicious shortcode in their biographical info field; WordPress core's wp_filter_kses() strips HTML tags but not shortcode syntax, and AMP content sanitizers run before do_shortcode() processes the archive description, so the resulting markup is never post-sanitized. When any visitor or administrator views the affected author archive/AMP page, the injected script executes in their browser. No public exploit identified at time of analysis, so this reflects the described mechanism rather than observed in-the-wild activity.