Advisories · Technology

mohammed_kaludi AMP for WP – Accelerated Mobile Pages.

Every CVE that names mohammed_kaludi AMP for WP – Accelerated Mobile Pages among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-103908 CVE record

CVSS 5.4 Medium

AMP for WP <= 1.1.18 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Author Biographical Info
- mohammed_kaludi AMP for WP – Accelerated Mobile Pages
- Code injection
Not analysed yet 6 Nov 2026
CVE-2026-97019 CVE record

CVSS 7.2 High

AMP for WP <= 1.1.17 - Unauthenticated Stored Cross-Site Scripting via 'headline-*' Shortcode Attribute
- mohammed_kaludi AMP for WP – Accelerated Mobile Pages
- Cross-site scripting (XSS)
Not analysed yet 28 Oct 2026
CVE-2026-83591 CVE record

CVSS 7.2 High

AMP for WP <= 1.1.16 - Unauthenticated Stored Cross-Site Scripting via Comment Content Regex Transformation
- mohammed_kaludi AMP for WP – Accelerated Mobile Pages
- Cross-site scripting (XSS)
Not analysed yet 25 Sept 2026
CVE-2026-6101 CVE record

CVSS 7.5 High

AMP for WP <= 1.1.12 - Authenticated (Author+) Arbitrary File Write via Role-Based Access Configuration with Local Font Upload
- mohammed_kaludi AMP for WP – Accelerated Mobile Pages
- Path traversal
Not analysed yet 7 Jul 2026
CVE-2026-0627 CVE record

CVSS 6.4 Medium

AMP for WP <= 1.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG File Upload
- mohammed_kaludi AMP for WP – Accelerated Mobile Pages
- Cross-site scripting (XSS)
Not analysed yet 9 Jan 2026
CVE-2025-14468 CVE record

CVSS 4.3 Medium

AMP for WP – Accelerated Mobile Pages <= 1.1.9 - Cross-Site Request Forgery to Comment Submission
- mohammed_kaludi AMP for WP – Accelerated Mobile Pages
- Cross-site request forgery (CSRF)
Not analysed yet 7 Jan 2026
CVE-2024-11254 CVE record

CVSS 6.1 Medium

AMP for WP – Accelerated Mobile Pages <= 1.1.1 - Reflected Cross-Site Scripting
- mohammed_kaludi AMP for WP – Accelerated Mobile Pages
- Cross-site scripting (XSS)
Not analysed yet 18 Dec 2024
CVE-2024-9598 CVE record

CVSS 8.8 High

AMP for WP – Accelerated Mobile Pages <= 1.0.99.1 - Cross-Site Request Forgery to Privilege Escalation
- mohammed_kaludi AMP for WP – Accelerated Mobile Pages
- Cross-site request forgery (CSRF)
Not analysed yet 25 Oct 2024
CVE-2024-6896 CVE record

CVSS 6.4 Medium

AMP for WP – Accelerated Mobile Pages <= 1.0.96.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- mohammed_kaludi AMP for WP – Accelerated Mobile Pages
- Cross-site scripting (XSS)
Not analysed yet 24 Jul 2024
CVE-2024-1043 CVE record

CVSS 6.5 Medium

AMP for WP <= 1.0.93.1 - Authenticated(Contributor+) Arbitrary Post Deletion via amppb_remove_saved_layout_data
- mohammed_kaludi AMP for WP – Accelerated Mobile Pages
- Broken access control
Not analysed yet 20 Feb 2024
CVE-2024-0587 CVE record

CVSS 6.1 Medium

Accelerated Mobile Pages <= 1.0.92.1 - Reflected Cross-Site Scripting
- mohammed_kaludi AMP for WP – Accelerated Mobile Pages
- Cross-site scripting (XSS)
Not analysed yet 23 Jan 2024
CVE-2023-6782 CVE record

CVSS 6.4 Medium

AMP for WP – Accelerated Mobile Pages <= 1.0.92 - Authenticated (Contributor+) Cross-Site Scripting via Shortcode
- mohammed_kaludi AMP for WP – Accelerated Mobile Pages
- Cross-site scripting (XSS)
Not analysed yet 11 Jan 2024