Skip to content
Noroxi

AMP for WP – Accelerated Mobile Pages

accelerated-mobile-pages · plugin

Known security vulnerabilities for AMP for WP – Accelerated Mobile Pages. Find out in seconds which version runs on your site with WP Lens.

15 known vulnerabilities

5 exploitable without logging in · latest Sep 25, 2026

Listed on wordpress.org · latest 1.1.18 · last updated Oct 1, 2026 · 70K+ installs

wordpress.org status checked on Oct 2, 2026

Vulnerabilities

  • CVE-2024-9598unauthenticated · needs a click≤ 1.0.99.1

    AMP for WP – Accelerated Mobile Pages <= 1.0.99.1 - Cross-Site Request Forgery to Privilege Escalation

    High 8.8

  • CVE-2026-6101author+≤ 1.1.12

    AMP for WP <= 1.1.12 - Authenticated (Author+) Arbitrary File Write via Role-Based Access Configuration with Local Font Upload

    High 7.5

  • CVE-2026-83591unauthenticated≤ 1.1.16

    AMP for WP <= 1.1.16 - Unauthenticated Stored Cross-Site Scripting via Comment Content Regex Transformation

    High 7.2

  • CVE-2024-1043contributor+≤ 1.0.93.1

    AMP for WP <= 1.0.93.1 - Authenticated(Contributor+) Arbitrary Post Deletion via amppb_remove_saved_layout_data

    Medium 6.5

  • CVE-2026-0627contributor+≤ 1.1.10

    AMP for WP <= 1.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG File Upload

    Medium 6.4

  • CVE-2024-43146login required≤ 1.0.96.1

    WordPress Accelerated Mobile Pages plugin <= 1.0.96.1 - Broken Access Control vulnerability

    Medium 6.3

  • CVE-2024-11254unauthenticated · needs a click≤ 1.1.1

    AMP for WP – Accelerated Mobile Pages <= 1.1.1 - Reflected Cross-Site Scripting

    Medium 6.1

  • CVE-2024-0587unauthenticated · needs a click≤ 1.0.92.1

    Accelerated Mobile Pages <= 1.0.92.1 - Reflected Cross-Site Scripting

    Medium 6.1

  • CVE-2023-48321login required≤ 1.0.88.1

    WordPress Accelerated Mobile Pages Plugin <= 1.0.88.1 is vulnerable to Cross Site Scripting (XSS)

    Medium 5.4

  • CVE-2018-20838login required

    ampforwp_save_steps_data in the AMP for WP plugin before 0.9.97.21 for WordPress allows stored XSS.

    Medium 5.4

  • CVE-2024-6896author+≤ 1.0.96.1

    AMP for WP – Accelerated Mobile Pages <= 1.0.96.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

    Medium 5.4

  • CVE-2023-6782contributor+≤ 1.0.92

    AMP for WP – Accelerated Mobile Pages <= 1.0.92 - Authenticated (Contributor+) Cross-Site Scripting via Shortcode

    Medium 5.4

  • CVE-2021-23209admin≤ 1.0.77.32

    WordPress AMP for WP – Accelerated Mobile Pages plugin <= 1.0.77.32 - Multiple Auth. Stored Cross-Site Scripting (XSS) vulnerabilities

    Medium 4.8

  • CVE-2021-23150admin≤ 1.0.77.31

    WordPress AMP for WP – Accelerated Mobile Pages plugin <= 1.0.77.31 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

    Medium 4.8

  • CVE-2025-14468unauthenticated · needs a click≤ 1.1.9

    AMP for WP – Accelerated Mobile Pages <= 1.1.9 - Cross-Site Request Forgery to Comment Submission

    Medium 4.3

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory