AMP for WP – Accelerated Mobile Pages — Vulnerabilities & Security Advisories 11

All 11 CVE vulnerabilities found in AMP for WP – Accelerated Mobile Pages, with AI-generated Chinese analysis, references, and POCs.

Vendor: Ahmed Kaludi, Mohammed Kaludi

CVE ID	Title	CVSS	Severity	Published
CVE-2026-83591	AMP for WP <= 1.1.16 - Unauthenticated Stored Cross-Site Scripting via Comment Content Regex Transformation CWE-79	7.2	High	2026-09-25
CVE-2026-6101	AMP for WP <= 1.1.12 - Authenticated (Author+) Arbitrary File Write via Role-Based Access Configuration with Local Font Upload CWE-73	7.5	High	2026-07-07
CVE-2026-0627	AMP for WP <= 1.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG File Upload CWE-79	6.4	Medium	2026-01-09
CVE-2025-14468	AMP for WP – Accelerated Mobile Pages <= 1.1.9 - Cross-Site Request Forgery to Comment Submission CWE-352	4.3	Medium	2026-01-07
CVE-2024-11254	AMP for WP – Accelerated Mobile Pages <= 1.1.1 - Reflected Cross-Site Scripting CWE-79	6.1	Medium	2024-12-18
CVE-2024-9598	AMP for WP – Accelerated Mobile Pages <= 1.0.99.1 - Cross-Site Request Forgery to Privilege Escalation CWE-352	8.8	High	2024-10-25
CVE-2024-6896	AMP for WP – Accelerated Mobile Pages <= 1.0.96.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload CWE-79	6.4	Medium	2024-07-24
CVE-2024-1043	AMP for WP <= 1.0.93.1 - Authenticated(Contributor+) Arbitrary Post Deletion via amppb_remove_saved_layout_data CWE-285	6.5	Medium	2024-02-20
CVE-2024-0587	Accelerated Mobile Pages <= 1.0.92.1 - Reflected Cross-Site Scripting CWE-79	6.1	Medium	2024-01-23
CVE-2023-6782	AMP for WP – Accelerated Mobile Pages <= 1.0.92 - Authenticated (Contributor+) Cross-Site Scripting via Shortcode CWE-79	6.4	Medium	2024-01-11
CVE-2023-48321	WordPress Accelerated Mobile Pages Plugin <= 1.0.88.1 is vulnerable to Cross Site Scripting (XSS) CWE-79	6.5	Medium	2023-11-30

All 11 known CVE vulnerabilities affecting AMP for WP – Accelerated Mobile Pages with full Chinese analysis, references, and POCs where available.