Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2024-9598 (GCVE-0-2024-9598)

Vulnerability from nvd – Published: 2024-10-25 07:37 – Updated: 2026-04-08 16:58

Title

AMP for WP – Accelerated Mobile Pages <= 1.0.99.1 - Cross-Site Request Forgery to Privilege Escalation

Summary

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.99.1. This is due to missing or incorrect nonce validation on the 'proxy' function. This makes it possible for unauthenticated attackers to send the logged in user's cookies to their own server via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-25 15:21 UTC

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

Wordfence mitre root Scorecard

References

3 references

URL	Tags
https://www.wordfence.com/threat-intel/vulnerabil…
https://plugins.trac.wordpress.org/browser/accele…
https://plugins.trac.wordpress.org/changeset/3174071/

Impacted products

2 products

Vendor	Product	Version
mohammed_kaludi	AMP for WP – Accelerated Mobile Pages	Affected: 0 , ≤ 1.0.99.1 (semver)
magazine3	amp_for_wp	Affected: 0 , ≤ 1.0.99.1 (semver) cpe:2.3:a:magazine3:amp_for_wp::::::wordpress::*

Credits

David Gallagher

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:magazine3:amp_for_wp:*:*:*:*:*:wordpress:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "amp_for_wp",
            "vendor": "magazine3",
            "versions": [
              {
                "lessThanOrEqual": "1.0.99.1",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-9598",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-25T15:21:59.575012Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-25T18:54:09.874Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "AMP for WP \u2013 Accelerated Mobile Pages",
          "vendor": "mohammed_kaludi",
          "versions": [
            {
              "lessThanOrEqual": "1.0.99.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "David Gallagher"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The AMP for WP \u2013 Accelerated Mobile Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.99.1. This is due to missing or incorrect nonce validation on the \u0027proxy\u0027 function. This makes it possible for unauthenticated attackers to send the logged in user\u0027s cookies to their own server via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:58:56.715Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6b155ec8-d69d-40cf-8bea-201629bc9ca6?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/tags/1.0.98/includes/options/redux-core/inc/class.p.php#L16"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3174071/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-10-24T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "AMP for WP \u2013 Accelerated Mobile Pages \u003c= 1.0.99.1 - Cross-Site Request Forgery to Privilege Escalation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2024-9598",
    "datePublished": "2024-10-25T07:37:59.702Z",
    "dateReserved": "2024-10-07T17:41:25.727Z",
    "dateUpdated": "2026-04-08T16:58:56.715Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-6782 (GCVE-0-2023-6782)

Vulnerability from nvd – Published: 2024-01-11 08:32 – Updated: 2026-04-08 17:19

Title

AMP for WP – Accelerated Mobile Pages <= 1.0.92 - Authenticated (Contributor+) Cross-Site Scripting via Shortcode

Summary

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.0.92 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Severity

6.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-01-11 14:46 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

Wordfence mitre root Scorecard

References

3 references

URL	Tags
https://www.wordfence.com/threat-intel/vulnerabil…
https://plugins.svn.wordpress.org/accelerated-mob…
https://plugins.trac.wordpress.org/changeset?sfp_…

Impacted products

1 product

Vendor	Product	Version
mohammed_kaludi	AMP for WP – Accelerated Mobile Pages	Affected: 0 , ≤ 1.0.92 (semver)

Credits

Ngô Thiên An

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T08:42:07.426Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c1cae64e-caed-43c0-9a75-9aa4234946a0?source=cve"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.svn.wordpress.org/accelerated-mobile-pages/trunk/templates/features.php"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3010797%40accelerated-mobile-pages%2Ftrunk\u0026old=2998126%40accelerated-mobile-pages%2Ftrunk\u0026sfp_email=\u0026sfph_mail="
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-6782",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-01-11T14:46:55.979242Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-17T21:09:14.450Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "AMP for WP \u2013 Accelerated Mobile Pages",
          "vendor": "mohammed_kaludi",
          "versions": [
            {
              "lessThanOrEqual": "1.0.92",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ng\u00f4 Thi\u00ean An"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The AMP for WP \u2013 Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin\u0027s shortcode(s) in all versions up to, and including, 1.0.92 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T17:19:56.112Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c1cae64e-caed-43c0-9a75-9aa4234946a0?source=cve"
        },
        {
          "url": "https://plugins.svn.wordpress.org/accelerated-mobile-pages/trunk/templates/features.php"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3010797%40accelerated-mobile-pages%2Ftrunk\u0026old=2998126%40accelerated-mobile-pages%2Ftrunk\u0026sfp_email=\u0026sfph_mail="
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2023-12-18T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "AMP for WP \u2013 Accelerated Mobile Pages \u003c= 1.0.92 - Authenticated (Contributor+) Cross-Site Scripting via Shortcode"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2023-6782",
    "datePublished": "2024-01-11T08:32:55.986Z",
    "dateReserved": "2023-12-13T15:02:41.145Z",
    "dateUpdated": "2026-04-08T17:19:56.112Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-48321 (GCVE-0-2023-48321)

Vulnerability from nvd – Published: 2023-11-30 16:28 – Updated: 2026-04-28 16:08

Title

WordPress Accelerated Mobile Pages Plugin <= 1.0.88.1 is vulnerable to Cross Site Scripting (XSS)

Summary

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ahmed Kaludi, Mohammed Kaludi AMP for WP – Accelerated Mobile Pages allows Stored XSS.This issue affects AMP for WP – Accelerated Mobile Pages: from n/a through 1.0.88.1.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

Patchstack mitre root Scorecard

References

1 reference

URL	Tags
https://patchstack.com/database/vulnerability/acc…	vdb-entry

Impacted products

1 product

Vendor	Product	Version
Ahmed Kaludi, Mohammed Kaludi	AMP for WP – Accelerated Mobile Pages	Affected: n/a , ≤ 1.0.88.1 (custom)

Credits

NGÔ THIÊN AN / ancorn_ from VNPT-VCI (Patchstack Alliance)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T21:23:39.603Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_transferred"
            ],
            "url": "https://patchstack.com/database/vulnerability/accelerated-mobile-pages/wordpress-amp-for-wp-accelerated-mobile-pages-plugin-1-0-88-1-cross-site-scripting-xss-vulnerability?_s_id=cve"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "accelerated-mobile-pages",
          "product": "AMP for WP \u2013 Accelerated Mobile Pages",
          "vendor": "Ahmed Kaludi, Mohammed Kaludi",
          "versions": [
            {
              "changes": [
                {
                  "at": "1.0.89",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "1.0.88.1",
              "status": "affected",
              "version": "n/a",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "NG\u00d4 THI\u00caN AN / ancorn_ from VNPT-VCI (Patchstack Alliance)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Ahmed Kaludi, Mohammed Kaludi AMP for WP \u2013 Accelerated Mobile Pages allows Stored XSS.\u003cp\u003eThis issue affects AMP for WP \u2013 Accelerated Mobile Pages: from n/a through 1.0.88.1.\u003c/p\u003e"
            }
          ],
          "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Ahmed Kaludi, Mohammed Kaludi AMP for WP \u2013 Accelerated Mobile Pages allows Stored XSS.This issue affects AMP for WP \u2013 Accelerated Mobile Pages: from n/a through 1.0.88.1."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-592",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-592 Stored XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-28T16:08:54.203Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/vulnerability/accelerated-mobile-pages/wordpress-amp-for-wp-accelerated-mobile-pages-plugin-1-0-88-1-cross-site-scripting-xss-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to\u00a01.0.89 or a higher version."
            }
          ],
          "value": "Update to\u00a01.0.89 or a higher version."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WordPress Accelerated Mobile Pages Plugin \u003c= 1.0.88.1 is vulnerable to Cross Site Scripting (XSS)",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2023-48321",
    "datePublished": "2023-11-30T16:28:35.721Z",
    "dateReserved": "2023-11-14T21:42:18.496Z",
    "dateUpdated": "2026-04-28T16:08:54.203Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2018-20838 (GCVE-0-2018-20838)

Vulnerability from nvd – Published: 2019-05-13 04:04 – Updated: 2024-08-05 12:12

Summary

ampforwp_save_steps_data in the AMP for WP plugin before 0.9.97.21 for WordPress allows stored XSS.

Severity

No CVSS data available.

CWE

n/a

Assigner

mitre mitre root Scorecard

References

4 references

URL	Tags
https://www.wordfence.com/blog/2018/11/xss-inject…	x_refsource_MISC
https://plugins.trac.wordpress.org/browser/accele…	x_refsource_MISC
https://wordpress.org/plugins/accelerated-mobile-…	x_refsource_MISC
https://ampforwp.com/critical-security-issues-has…	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T12:12:28.338Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.wordfence.com/blog/2018/11/xss-injection-campaign-exploits-wordpress-amp-plugin/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/trunk/changelog.txt"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wordpress.org/plugins/accelerated-mobile-pages/#developers"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://ampforwp.com/critical-security-issues-has-been-fixed-in-0-9-97-20-version/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ampforwp_save_steps_data in the AMP for WP plugin before 0.9.97.21 for WordPress allows stored XSS."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-05-14T20:01:20.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.wordfence.com/blog/2018/11/xss-injection-campaign-exploits-wordpress-amp-plugin/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/trunk/changelog.txt"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wordpress.org/plugins/accelerated-mobile-pages/#developers"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://ampforwp.com/critical-security-issues-has-been-fixed-in-0-9-97-20-version/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-20838",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "ampforwp_save_steps_data in the AMP for WP plugin before 0.9.97.21 for WordPress allows stored XSS."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.wordfence.com/blog/2018/11/xss-injection-campaign-exploits-wordpress-amp-plugin/",
              "refsource": "MISC",
              "url": "https://www.wordfence.com/blog/2018/11/xss-injection-campaign-exploits-wordpress-amp-plugin/"
            },
            {
              "name": "https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/trunk/changelog.txt",
              "refsource": "MISC",
              "url": "https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/trunk/changelog.txt"
            },
            {
              "name": "https://wordpress.org/plugins/accelerated-mobile-pages/#developers",
              "refsource": "MISC",
              "url": "https://wordpress.org/plugins/accelerated-mobile-pages/#developers"
            },
            {
              "name": "https://ampforwp.com/critical-security-issues-has-been-fixed-in-0-9-97-20-version/",
              "refsource": "MISC",
              "url": "https://ampforwp.com/critical-security-issues-has-been-fixed-in-0-9-97-20-version/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-20838",
    "datePublished": "2019-05-13T04:04:18.000Z",
    "dateReserved": "2019-05-12T00:00:00.000Z",
    "dateUpdated": "2024-08-05T12:12:28.338Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-9598 (GCVE-0-2024-9598)

Vulnerability from cvelistv5 – Published: 2024-10-25 07:37 – Updated: 2026-04-08 16:58

Title

AMP for WP – Accelerated Mobile Pages <= 1.0.99.1 - Cross-Site Request Forgery to Privilege Escalation

Summary

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.99.1. This is due to missing or incorrect nonce validation on the 'proxy' function. This makes it possible for unauthenticated attackers to send the logged in user's cookies to their own server via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-25 15:21 UTC

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

Wordfence mitre root Scorecard

References

3 references

URL	Tags
https://www.wordfence.com/threat-intel/vulnerabil…
https://plugins.trac.wordpress.org/browser/accele…
https://plugins.trac.wordpress.org/changeset/3174071/

Impacted products

2 products

Vendor	Product	Version
mohammed_kaludi	AMP for WP – Accelerated Mobile Pages	Affected: 0 , ≤ 1.0.99.1 (semver)
magazine3	amp_for_wp	Affected: 0 , ≤ 1.0.99.1 (semver) cpe:2.3:a:magazine3:amp_for_wp::::::wordpress::*

Credits

David Gallagher

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:magazine3:amp_for_wp:*:*:*:*:*:wordpress:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "amp_for_wp",
            "vendor": "magazine3",
            "versions": [
              {
                "lessThanOrEqual": "1.0.99.1",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-9598",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-25T15:21:59.575012Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-25T18:54:09.874Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "AMP for WP \u2013 Accelerated Mobile Pages",
          "vendor": "mohammed_kaludi",
          "versions": [
            {
              "lessThanOrEqual": "1.0.99.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "David Gallagher"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The AMP for WP \u2013 Accelerated Mobile Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.99.1. This is due to missing or incorrect nonce validation on the \u0027proxy\u0027 function. This makes it possible for unauthenticated attackers to send the logged in user\u0027s cookies to their own server via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:58:56.715Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6b155ec8-d69d-40cf-8bea-201629bc9ca6?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/tags/1.0.98/includes/options/redux-core/inc/class.p.php#L16"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3174071/"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-10-24T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "AMP for WP \u2013 Accelerated Mobile Pages \u003c= 1.0.99.1 - Cross-Site Request Forgery to Privilege Escalation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2024-9598",
    "datePublished": "2024-10-25T07:37:59.702Z",
    "dateReserved": "2024-10-07T17:41:25.727Z",
    "dateUpdated": "2026-04-08T16:58:56.715Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-6782 (GCVE-0-2023-6782)

Vulnerability from cvelistv5 – Published: 2024-01-11 08:32 – Updated: 2026-04-08 17:19

Title

AMP for WP – Accelerated Mobile Pages <= 1.0.92 - Authenticated (Contributor+) Cross-Site Scripting via Shortcode

Summary

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.0.92 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Severity

6.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-01-11 14:46 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

Wordfence mitre root Scorecard

References

3 references

URL	Tags
https://www.wordfence.com/threat-intel/vulnerabil…
https://plugins.svn.wordpress.org/accelerated-mob…
https://plugins.trac.wordpress.org/changeset?sfp_…

Impacted products

1 product

Vendor	Product	Version
mohammed_kaludi	AMP for WP – Accelerated Mobile Pages	Affected: 0 , ≤ 1.0.92 (semver)

Credits

Ngô Thiên An

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T08:42:07.426Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c1cae64e-caed-43c0-9a75-9aa4234946a0?source=cve"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.svn.wordpress.org/accelerated-mobile-pages/trunk/templates/features.php"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3010797%40accelerated-mobile-pages%2Ftrunk\u0026old=2998126%40accelerated-mobile-pages%2Ftrunk\u0026sfp_email=\u0026sfph_mail="
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-6782",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-01-11T14:46:55.979242Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-17T21:09:14.450Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "AMP for WP \u2013 Accelerated Mobile Pages",
          "vendor": "mohammed_kaludi",
          "versions": [
            {
              "lessThanOrEqual": "1.0.92",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ng\u00f4 Thi\u00ean An"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The AMP for WP \u2013 Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin\u0027s shortcode(s) in all versions up to, and including, 1.0.92 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T17:19:56.112Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c1cae64e-caed-43c0-9a75-9aa4234946a0?source=cve"
        },
        {
          "url": "https://plugins.svn.wordpress.org/accelerated-mobile-pages/trunk/templates/features.php"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3010797%40accelerated-mobile-pages%2Ftrunk\u0026old=2998126%40accelerated-mobile-pages%2Ftrunk\u0026sfp_email=\u0026sfph_mail="
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2023-12-18T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "AMP for WP \u2013 Accelerated Mobile Pages \u003c= 1.0.92 - Authenticated (Contributor+) Cross-Site Scripting via Shortcode"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2023-6782",
    "datePublished": "2024-01-11T08:32:55.986Z",
    "dateReserved": "2023-12-13T15:02:41.145Z",
    "dateUpdated": "2026-04-08T17:19:56.112Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-48321 (GCVE-0-2023-48321)

Vulnerability from cvelistv5 – Published: 2023-11-30 16:28 – Updated: 2026-04-28 16:08

Title

WordPress Accelerated Mobile Pages Plugin <= 1.0.88.1 is vulnerable to Cross Site Scripting (XSS)

Summary

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ahmed Kaludi, Mohammed Kaludi AMP for WP – Accelerated Mobile Pages allows Stored XSS.This issue affects AMP for WP – Accelerated Mobile Pages: from n/a through 1.0.88.1.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

Patchstack mitre root Scorecard

References

1 reference

URL	Tags
https://patchstack.com/database/vulnerability/acc…	vdb-entry

Impacted products

1 product

Vendor	Product	Version
Ahmed Kaludi, Mohammed Kaludi	AMP for WP – Accelerated Mobile Pages	Affected: n/a , ≤ 1.0.88.1 (custom)

Credits

NGÔ THIÊN AN / ancorn_ from VNPT-VCI (Patchstack Alliance)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T21:23:39.603Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_transferred"
            ],
            "url": "https://patchstack.com/database/vulnerability/accelerated-mobile-pages/wordpress-amp-for-wp-accelerated-mobile-pages-plugin-1-0-88-1-cross-site-scripting-xss-vulnerability?_s_id=cve"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unaffected",
          "packageName": "accelerated-mobile-pages",
          "product": "AMP for WP \u2013 Accelerated Mobile Pages",
          "vendor": "Ahmed Kaludi, Mohammed Kaludi",
          "versions": [
            {
              "changes": [
                {
                  "at": "1.0.89",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "1.0.88.1",
              "status": "affected",
              "version": "n/a",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "NG\u00d4 THI\u00caN AN / ancorn_ from VNPT-VCI (Patchstack Alliance)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Ahmed Kaludi, Mohammed Kaludi AMP for WP \u2013 Accelerated Mobile Pages allows Stored XSS.\u003cp\u003eThis issue affects AMP for WP \u2013 Accelerated Mobile Pages: from n/a through 1.0.88.1.\u003c/p\u003e"
            }
          ],
          "value": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in Ahmed Kaludi, Mohammed Kaludi AMP for WP \u2013 Accelerated Mobile Pages allows Stored XSS.This issue affects AMP for WP \u2013 Accelerated Mobile Pages: from n/a through 1.0.88.1."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-592",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-592 Stored XSS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-28T16:08:54.203Z",
        "orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
        "shortName": "Patchstack"
      },
      "references": [
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://patchstack.com/database/vulnerability/accelerated-mobile-pages/wordpress-amp-for-wp-accelerated-mobile-pages-plugin-1-0-88-1-cross-site-scripting-xss-vulnerability?_s_id=cve"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update to\u00a01.0.89 or a higher version."
            }
          ],
          "value": "Update to\u00a01.0.89 or a higher version."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WordPress Accelerated Mobile Pages Plugin \u003c= 1.0.88.1 is vulnerable to Cross Site Scripting (XSS)",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
    "assignerShortName": "Patchstack",
    "cveId": "CVE-2023-48321",
    "datePublished": "2023-11-30T16:28:35.721Z",
    "dateReserved": "2023-11-14T21:42:18.496Z",
    "dateUpdated": "2026-04-28T16:08:54.203Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2018-20838 (GCVE-0-2018-20838)

Vulnerability from cvelistv5 – Published: 2019-05-13 04:04 – Updated: 2024-08-05 12:12

Summary

ampforwp_save_steps_data in the AMP for WP plugin before 0.9.97.21 for WordPress allows stored XSS.

Severity

No CVSS data available.

CWE

n/a

Assigner

mitre mitre root Scorecard

References

4 references

URL	Tags
https://www.wordfence.com/blog/2018/11/xss-inject…	x_refsource_MISC
https://plugins.trac.wordpress.org/browser/accele…	x_refsource_MISC
https://wordpress.org/plugins/accelerated-mobile-…	x_refsource_MISC
https://ampforwp.com/critical-security-issues-has…	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T12:12:28.338Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.wordfence.com/blog/2018/11/xss-injection-campaign-exploits-wordpress-amp-plugin/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/trunk/changelog.txt"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wordpress.org/plugins/accelerated-mobile-pages/#developers"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://ampforwp.com/critical-security-issues-has-been-fixed-in-0-9-97-20-version/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ampforwp_save_steps_data in the AMP for WP plugin before 0.9.97.21 for WordPress allows stored XSS."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-05-14T20:01:20.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.wordfence.com/blog/2018/11/xss-injection-campaign-exploits-wordpress-amp-plugin/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/trunk/changelog.txt"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wordpress.org/plugins/accelerated-mobile-pages/#developers"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://ampforwp.com/critical-security-issues-has-been-fixed-in-0-9-97-20-version/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-20838",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "ampforwp_save_steps_data in the AMP for WP plugin before 0.9.97.21 for WordPress allows stored XSS."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.wordfence.com/blog/2018/11/xss-injection-campaign-exploits-wordpress-amp-plugin/",
              "refsource": "MISC",
              "url": "https://www.wordfence.com/blog/2018/11/xss-injection-campaign-exploits-wordpress-amp-plugin/"
            },
            {
              "name": "https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/trunk/changelog.txt",
              "refsource": "MISC",
              "url": "https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/trunk/changelog.txt"
            },
            {
              "name": "https://wordpress.org/plugins/accelerated-mobile-pages/#developers",
              "refsource": "MISC",
              "url": "https://wordpress.org/plugins/accelerated-mobile-pages/#developers"
            },
            {
              "name": "https://ampforwp.com/critical-security-issues-has-been-fixed-in-0-9-97-20-version/",
              "refsource": "MISC",
              "url": "https://ampforwp.com/critical-security-issues-has-been-fixed-in-0-9-97-20-version/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-20838",
    "datePublished": "2019-05-13T04:04:18.000Z",
    "dateReserved": "2019-05-12T00:00:00.000Z",
    "dateUpdated": "2024-08-05T12:12:28.338Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Find a vulnerability

Search criteria

8 vulnerabilities found for amp_for_wp by magazine3

CVE-2024-9598 (GCVE-0-2024-9598)

CVE-2023-6782 (GCVE-0-2023-6782)

CVE-2023-48321 (GCVE-0-2023-48321)

CVE-2018-20838 (GCVE-0-2018-20838)

CVE-2024-9598 (GCVE-0-2024-9598)

CVE-2023-6782 (GCVE-0-2023-6782)

CVE-2023-48321 (GCVE-0-2023-48321)

CVE-2018-20838 (GCVE-0-2018-20838)