AMP for WP <= 1.1.17 - Unauthenticated Stored Cross-Site Scripting via 'headline-*' Shortcode Attribute

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-97019 · Microsoft / collected KEV context

cve-program · CVE-2026-97019

• https://www.wordfence.com/threat-intel/vulnerabilities/id/be16349f-31aa-41b8-a4fa-95db3141ba9b?source=cve
• https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/tags/1.1.17/includes/thirdparty-compatibility.php#L1594
• https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/tags/1.1.17/includes/thirdparty-compatibility.php#L1565
• https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/tags/1.1.17/components/loop/loop.php#L69
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3722863%40accelerated-mobile-pages&new=3722863%40accelerated-mobile-pages

• AMP for WP <= 1.1.17 - Unauthenticated Stored Cross-Site Scripting via 'headline-*' Shortcode Attribute · Newly collected advisory · 28 Oct 2026