ampforwp_save_steps_data in the AMP for WP plugin prior to 0.9.97.21 for WordPress allows stored XSS.
magazine3 amp for wp