AMP for WP – Accelerated Mobile Pages vulnerabilities

Product

AMP for WP – Accelerated Mobile Pages

by mohammed_kaludi · last CVE Oct 28, 2026

CVEs

On KEV

8.8

Max CVSS

New 30D

Vulnerabilities11 In the news0 Timeline

Severity mix

Critical 0High 4Medium 7Low 0

Severity

All severities11 Critical0 High4 Medium7 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add AMP for WP – Accelerated Mobile Pages to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2024-9598	8.8	0%	Oct 25	AMP for WP – Accelerated Mobile Pages <= 1.0.99.1 - Cross-Site Request Forgery to Privilege Escalation Affected: through 1.0.99.1
CVE-2026-6101	7.5	1%	Jul 7	AMP for WP <= 1.1.12 - Authenticated (Author+) Arbitrary File Write via Role-Based Access Configuration with Local Font Upload Affected: through 1.1.12
CVE-2026-97019 New	7.2	0%	Oct 28	AMP for WP <= 1.1.17 - Unauthenticated Stored Cross-Site Scripting via 'headline-*' Shortcode Attribute Affected: through 1.1.17
CVE-2026-83591	7.2	0%	Sep 25	AMP for WP <= 1.1.16 - Unauthenticated Stored Cross-Site Scripting via Comment Content Regex Transformation Affected: through 1.1.16
CVE-2024-1043	6.5	1%	Feb 20	AMP for WP <= 1.0.93.1 - Authenticated(Contributor+) Arbitrary Post Deletion via amppb_remove_saved_layout_data Affected: through 1.0.93.1
CVE-2026-0627	6.4	0%	Jan 9	AMP for WP <= 1.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG File Upload Affected: through 1.1.10
CVE-2024-11254	6.1	0%	Dec 18	AMP for WP – Accelerated Mobile Pages <= 1.1.1 - Reflected Cross-Site Scripting Affected: through 1.1.1
CVE-2024-0587	6.1	0%	Jan 23	Accelerated Mobile Pages <= 1.0.92.1 - Reflected Cross-Site Scripting Affected: through 1.0.92.1
CVE-2024-6896	5.4	0%	Jul 24	AMP for WP – Accelerated Mobile Pages <= 1.0.96.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload Affected: through 1.0.96.1
CVE-2023-6782	5.4	0%	Jan 11	AMP for WP – Accelerated Mobile Pages <= 1.0.92 - Authenticated (Contributor+) Cross-Site Scripting via Shortcode Affected: through 1.0.92
CVE-2025-14468	4.3	0%	Jan 7	AMP for WP – Accelerated Mobile Pages <= 1.1.9 - Cross-Site Request Forgery to Comment Submission Affected: through 1.1.9