AMP for WP – Accelerated Mobile Pages vulnerabilities

Product

AMP for WP – Accelerated Mobile Pages

by mohammed_kaludi · last CVE Oct 28, 2026

CVEs

On KEV

7.5

Max CVSS

New 30D

Severity mix

Critical 0High 3Medium 1Low 0

Severity

Exploitation

Watch

Add AMP for WP – Accelerated Mobile Pages to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-6101	7.5	1%	Jul 7	AMP for WP <= 1.1.12 - Authenticated (Author+) Arbitrary File Write via Role-Based Access Configuration with Local Font Upload Affected: through 1.1.12
CVE-2026-97019 New	7.2	–	Oct 28	AMP for WP <= 1.1.17 - Unauthenticated Stored Cross-Site Scripting via 'headline-*' Shortcode Attribute Affected: through 1.1.17
CVE-2026-83591	7.2	0%	Sep 25	AMP for WP <= 1.1.16 - Unauthenticated Stored Cross-Site Scripting via Comment Content Regex Transformation Affected: through 1.1.16
CVE-2024-11254	6.1	0%	Dec 18	AMP for WP – Accelerated Mobile Pages <= 1.1.1 - Reflected Cross-Site Scripting Affected: through 1.1.1