Reflected script execution via unsanitized parameter output

Cross-site scripting in AMP Cloud AMP+ Plus through 3.0 allows remote attackers to execute script in high-privilege users’ browsers via crafted links. The plugin reflects a request parameter into generated pages without sanitizing or escaping it. Exploitation is unauthenticated but requires tricking an administrator or other privileged user into clicking the attacker’s link; the resulting script can read or modify data available in that user’s browser context.