CVE-2026-83591 is a stored cross-site scripting vulnerability in the AMP for WP – Accelerated Mobile Pages plugin for WordPress, affecting all versions up to 1.1.16. The flaw is due to improper neutralization of input during web page generation, specifically in comment content processed via regex transformation. The vulnerability allows unauthenticated attackers to inject arbitrary web scripts using only allowed comment tags and attributes (such as anchor tags with href and title). The AMP sanitizer pipeline fails to block javascript: protocol URIs, resulting in malicious scripts not being removed during comment saving or AMP output rendering.

An attacker can inject persistent malicious scripts into comment content that execute in the browsers of users who view the affected pages. This can lead to information disclosure or other client-side impacts. The vulnerability requires no authentication and has a low attack complexity. The CVSS 3.1 base score is 7.2 (high severity), reflecting network attack vector, no privileges required, no user interaction, and partial confidentiality and integrity impact.

No official patch or fix is currently documented. Users should monitor the vendor advisory for updates. Until a fix is available, consider disabling comments or restricting comment capabilities to trusted users as a temporary mitigation. Avoid exposing the affected plugin on public-facing sites where unauthenticated users can submit comments.