PLUGIN SECURITY
Is Accelerated Mobile Pages safe?
AMP for WP is the most recommended AMP plugin by the community. Automatically add Accelerated Mobile Pages (Google AMP Project) functionality on your …
What this plugin does
- Slug:
accelerated-mobile-pages - Author: Mohammed Kaludi
- 70000+ active installs
- 88/100 rating (1317 reviews on wordpress.org)
- 19271540 all-time downloads
- On WordPress.org since 2016-02-07
accelerated mobile pagesampgoogle ampmobileseo
Maintenance status
- Latest known version: 1.1.15
- Last updated: 2026-07-24 9:52am GMT
- Tested up to WordPress: 7.0.4
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
14 known CVEs on file for Accelerated Mobile Pages.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-6101 | AMP for WP – Accelerated Mobile Pages [accelerated-mobile-pages] < 1.1.13 | External Control of File Name or Path | High 7.5 | < 1.1.13 | 1.1.13 | 2026-07-06 | ✓ fixed in latest |
| CVE-2025-14468 | AMP for WP – Accelerated Mobile Pages [accelerated-mobile-pages] < 1.1.10 | Cross-Site Request Forgery (CSRF) | Medium 4.3 | < 1.1.10 | 1.1.10 | 2026-01-06 | ✓ fixed in latest |
| CVE-2024-11254 | AMP for WP – Accelerated Mobile Pages [accelerated-mobile-pages] < 1.1.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 1.1.2 | 1.1.2 | 2024-12-17 | ✓ fixed in latest |
| CVE-2024-9598 | AMP for WP – Accelerated Mobile Pages [accelerated-mobile-pages] < 1.0.99.2 | Cross-Site Request Forgery (CSRF) | High 8.8 | < 1.0.99.2 | 1.0.99.2 | 2024-10-24 | ✓ fixed in latest |
| CVE-2024-43146 | AMP for WP – Accelerated Mobile Pages [accelerated-mobile-pages] < 1.0.97 | Missing Authorization | Medium 6.3 | < 1.0.97 | 1.0.97 | 2024-08-07 | ✓ fixed in latest |
| CVE-2024-6896 | AMP for WP – Accelerated Mobile Pages [accelerated-mobile-pages] < 1.0.97 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 1.0.97 | 1.0.97 | 2024-07-23 | ✓ fixed in latest |
| CVE-2024-1043 | AMP for WP – Accelerated Mobile Pages [accelerated-mobile-pages] < 1.0.93.2 | Improper Authorization | Medium 6.5 | < 1.0.93.2 | 1.0.93.2 | 2024-02-06 | ✓ fixed in latest |
| CVE-2024-0587 | AMP for WP – Accelerated Mobile Pages [accelerated-mobile-pages] < 1.0.93 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 1.0.93 | 1.0.93 | 2024-01-22 | ✓ fixed in latest |
+ 11 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2023-6782 | AMP for WP – Accelerated Mobile Pages [accelerated-mobile-pages] < 1.0.92.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 1.0.92.1 | 1.0.92.1 | 2023-12-18 | ✓ fixed in latest |
| CVE-2023-48321 | AMP for WP – Accelerated Mobile Pages [accelerated-mobile-pages] < 1.0.89 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.5 | < 1.0.89 | 1.0.89 | 2023-11-23 | ✓ fixed in latest |
| CVE-2021-23209 | AMP for WP – Accelerated Mobile Pages [accelerated-mobile-pages] < 1.0.77.33 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 1.0.77.33 | 1.0.77.33 | 2021-12-15 | ✓ fixed in latest |
| CVE-2021-23150 | AMP for WP – Accelerated Mobile Pages [accelerated-mobile-pages] < 1.0.77.33 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 1.0.77.33 | 1.0.77.33 | 2021-12-11 | ✓ fixed in latest |
| CVE-2018-20838 | AMP for WP – Accelerated Mobile Pages [accelerated-mobile-pages] < 0.9.97.21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 0.9.97.21 | 0.9.97.21 | 2018-11-20 | ✓ fixed in latest |
| — | AMP for WP – Accelerated Mobile Pages [accelerated-mobile-pages] < 0.9.97.20 | — | Unknown | < 0.9.97.20 | 0.9.97.20 | 2018-11-13 | ✓ fixed in latest |
| — | AMP for WP – Accelerated Mobile Pages [accelerated-mobile-pages] < 0.9.97.20 | — | Unknown | < 0.9.97.20 | 0.9.97.20 | 2018-10-20 | ✓ fixed in latest |
| — | AMP for WP – Accelerated Mobile Pages [accelerated-mobile-pages] < 1.1.11 | — | Unknown | < 1.1.11 | 1.1.11 | 0000-00-00 | ✓ fixed in latest |
| — | AMP for WP – Accelerated Mobile Pages [accelerated-mobile-pages] < 0.9.97.20 | — | Unknown | < 0.9.97.20 | 0.9.97.20 | — | ✓ fixed in latest |
| — | Accelerated Mobile Pages <= 0.9.97.19 - Multiple Unauthenticated Vulnerabilities | — | Unknown | < 0.9.97.20 | 0.9.97.20 | — | ✓ fixed in latest |
| CVE-2026-0627 | AMP for WP < 1.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via SVG File Upload | — | Unknown | < 1.1.11 | 1.1.11 | — | ✓ fixed in latest |
How to fix it
Keep Accelerated Mobile Pages updated — 1.1.15 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- AMP — 400000+ active installs — 76/100 (367) — max PHP 8.4
- Ad Inserter – Ad Manager & AdSense Ads — 300000+ active installs — 98/100 (2428) — max PHP 8.4
- Head, Footer and Post Injections — 200000+ active installs — 98/100 (735) — max PHP 8.4
- Schema & Structured Data for WP & AMP — 100000+ active installs — 90/100 (252) — max PHP 8.4
- Web Stories — 60000+ active installs — 84/100 (87)
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.