Security readout for executives and security teams
Plain-English summary
CVE-2018-20838 is a stored cross-site scripting flaw in the AMP for WP WordPress plugin. Affected sites running plugin versions before the fixed release could store malicious script content that later executes for site users or administrators. Public reporting tied this plugin issue to a 2018 XSS injection campaign.
Executive priority
Treat this as urgent for any public WordPress site using AMP for WP. Stored XSS can support site compromise, visitor abuse, or administrator-session targeting. Prioritize inventory, upgrade confirmation, and content review.
Technical view
The CVE identifies stored XSS in the ampforwp_save_steps_data function of AMP for WP before 0.9.97.21. The bundle does not provide CVSS, CWE, prerequisites, or exact payload details. Vendor-related references indicate critical security fixes around 0.9.97.20, while the CVE text names before 0.9.97.21.
Likely exposure
Exposure is limited to WordPress sites using the AMP for WP plugin below the fixed version cited by the CVE. Sites without this plugin are not indicated as affected by the supplied sources.
Exploitation context
CISA KEV status is false in the bundle. However, a cited Wordfence source describes an XSS injection campaign exploiting the WordPress AMP plugin in 2018. The sources do not prove current active exploitation.
Researcher notes
The supplied metadata lacks CVSS, CWE, and affected CPEs. There is a version discrepancy worth validating: the CVE says before 0.9.97.21, while vendor-related references mention critical fixes in 0.9.97.20.
Mitigation direction
- Inventory WordPress sites for the AMP for WP plugin.
- Upgrade AMP for WP beyond the affected version range.
- Review vendor guidance for the exact fixed release.
- Remove the plugin if it is unused or unsupported.
- Check WordPress admin users and content for suspicious changes.
Validation and detection
- Confirm installed AMP for WP version on each WordPress site.
- Compare findings against the CVE fixed-version statement.
- Review plugin changelog entries around 0.9.97.20 and 0.9.97.21.
- Inspect site content for unexpected stored scripts or injected markup.
- Check web and WordPress logs for suspicious admin activity.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-20838 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/blog/2018/11/xss-injection-campaign-exploits-wordpress-amp-plugin/CVE reference · x_refsource_MISC
- https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/trunk/changelog.txtCVE reference · x_refsource_MISC
- https://wordpress.org/plugins/accelerated-mobile-pages/#developersCVE reference · x_refsource_MISC
- https://ampforwp.com/critical-security-issues-has-been-fixed-in-0-9-97-20-version/CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.