This vulnerability allows authenticated users with Contributor or higher privilege to upload specially crafted SVG files that are stored and later displayed to other visitors. Because the plugin only strips <script> tags, it fails to remove event handlers (onload, onerror, onmouseover), foreignObject elements and animation attributes, which serve as additional XSS vectors. When a victim opens the uploaded SVG, the malicious script runs in the victim’s browser, enabling script exploitation that can steal session cookies, deface content or launch further attacks, thereby compromising the confidentiality and integrity of the site.

The affected product is the AMP for WP – Accelerated Mobile Pages plugin for WordPress, as distributed by mohammed_kaludi. All releases up to and including version 1.1.10 are vulnerable. Users running any of these versions on a WordPress installation should consider this plugin to be at risk.

The CVSSv3.1 score of 6.4 indicates a medium to high severity. The EPSS score is below 1%, suggesting exploitation is currently unlikely, and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, because it requires only a Contributor‑level account—a role that many sites grant to legitimate content editors—the risk of exploitation remains serious. An attacker can exploit the flaw by authenticating with a Contributor or administrator account, uploading a crafted SVG file, and then relying on the file’s public display to trigger the script in any user who views it.