The AMP for WP – Accelerated Mobile Pages plugin for WordPress suffers from a reflected XSS vulnerability via the 'disqus_name' parameter. This parameter is not properly sanitized or escaped in the executed JavaScript, enabling injection of arbitrary web scripts. An attacker can exploit this by crafting a malicious link that, when clicked by a user, executes the injected script in the context of the vulnerable site. This affects all plugin versions up to 1.0.92.1. The vulnerability has a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of the affected website for users who click a malicious link. This can lead to limited confidentiality and integrity impacts such as theft of user session data or manipulation of page content. There is no direct impact on system availability. The vulnerability affects all versions up to 1.0.92.1 of the AMP for WP plugin.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or restricting use of the affected parameter or plugin, and avoid clicking suspicious links. Monitor the vendor's channels for updates and apply any official patches once released.