Summary

• Vulnerability: Authenticated (Administrator) stored cross-site scripting (XSS).
• Affected software: AMP Enhancer — Compatibility Layer for Official AMP Plugin, versions ≤1.0.49.
• CVE: CVE-2026-2027
• Severity: Medium (maintainer rating CVSS 5.9). Real-world impact depends on attacker access to an admin account.
• Exploitation prerequisites: Administrator privileges on the site (or convincing an admin to save malicious CSS).
• Immediate mitigations: deactivate or remove the plugin; inspect and sanitize the stored setting in the database; restrict admin accounts; apply virtual patches / WAF rules to block malicious CSS payloads while preparing a full clean-up.
• Recovery: If compromise is suspected, isolate the site, rotate credentials, scan and remove injected content, and restore from a clean backup if necessary.

Why this stored XSS matters — even with admin-only requirements

Although exploitation requires an administrator to save the payload, the attack surface is still significant:

• Stolen or phished admin credentials allow a persistent foothold via stored XSS.
• Malicious contractors or insiders with admin access can intentionally inject payloads.
• Social engineering can trick an admin into pasting seemingly legitimate CSS that contains hidden payloads.

Possible consequences include session theft, site-wide redirects, SEO poisoning, backdoor script injection, and reputation damage. Because the payload is stored in a configuration and served site-wide, a single successful injection can affect every visitor and administrator who loads affected pages.

How the issue works (technical overview)

1. The plugin provides an “AMP Custom CSS” setting where administrators can enter CSS for AMP pages.
2. The setting is persisted in the database and later echoed into page markup for AMP output.
3. Insufficient sanitisation allows input that can be interpreted by the browser as executable or able to break out of the CSS context (for example, constructs that close a style block or introduce HTML).
4. Because the content is stored and output to visitors, the XSS is persistent (stored) and executes on subsequent page views.

Note: modern browsers and legacy quirks can turn unexpected sequences into executable actions when user-controlled data is output without safe encoding.

Realistic exploitation scenarios

• Stolen admin credentials: attacker logs in, pastes malicious content into AMP Custom CSS, and the payload is served to visitors.
• Social engineering: admin is convinced to paste “recommended CSS” from an untrusted source that contains obfuscated payloads.
• Malicious insider: an employee or contractor with admin access stores a payload to steal data or sabotage the site.

Signs you may already be affected

• Unexpected inline JavaScript or HTML fragments in page source or inside styles.
• Site pages redirecting to external domains.
• Unusual dashboard behavior or unexpected admin notifications.
• New or unknown admin users, edited posts/pages you didn’t make, suspicious cron tasks, or modified core/theme/plugin files.
• Search engine warnings, blacklisting, or unusual traffic patterns.

If you use an affected version of the plugin and notice these signs, assume potential compromise and follow containment steps immediately.

Immediate steps for site owners (ordered)

1. Put the site into maintenance mode or reduce exposure: temporarily restrict public access while investigating.
2. Deactivate the AMP Enhancer plugin: the simplest immediate mitigation is to deactivate or remove the plugin to stop it from serving stored content.
3. Inspect and clean the AMP Custom CSS setting:
   • Check the plugin option where custom CSS is stored (common keys might include amp_custom_css or plugin-specific option names).
   • If you find unexpected content, remove it or set the field to an empty string.
   • Example WP-CLI: wp option get amp_custom_css and to clear: wp option update amp_custom_css ''
   • SQL inspection example (always back up first):

   SELECT option_name, option_value FROM wp_options WHERE option_name LIKE '%amp%' OR option_value LIKE '%javascript:%' OR option_value LIKE '%

4. Rotate credentials and lock admin access:
   • Reset passwords for all administrator accounts and enforce strong, unique passwords.
   • Require two-factor authentication for all admins where possible.
   • Remove or downgrade unknown admin users.
5. Review recent admin activity: check audit logs (if available) to identify who changed settings; enable logging if absent.
6. Scan the site for other indicators: perform a full-site malware scan and inspect posts, options, theme files, and uploads for injected code.
7. Review backups: if you detect a compromise and cannot clean confidently, restore from a known-good backup taken prior to the injection.
8. Apply virtual patching / WAF rules as an interim measure: block suspicious payloads from being saved and prevent already-stored payloads from reaching clients (details below).
9. Monitor and re-scan regularly after cleanup to detect reinfection or repeated malicious changes.