AMP for WP Stored Cross-Site Scripting Vulnerability via SVG File Upload

A stored cross-site scripting vulnerability has been identified in the AMP for WP plugin for WordPress, affecting all versions through 1.1.10. The issue arises from inadequate sanitization of SVG file content, which only removes script tags while allowing other XSS vectors, such as event handlers, foreignObject elements, and SVG animation attributes. This vulnerability enables authenticated attackers with Author-level access and above to inject arbitrary web scripts through malicious SVG file uploads, which execute when a user views the uploaded file.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the affected SVG file.

Remediation

Users are advised to update the AMP for WP plugin to version 1.1.11 or a newer patched version.