CVE-2024-6896

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.96.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.

• CWE-79
• CWE-79

• https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/tags/1.0.96.1/templates/features.php#L7159Patch
• https://plugins.trac.wordpress.org/changeset/3123278/Patch
• https://wordpress.org/plugins/accelerated-mobile-pages/#developersProduct, Release Notes
• https://www.wordfence.com/threat-intel/vulnerabilities/id/b0a5fdb9-4e36-43ce-88ce-cd75bb1d1e25?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/browser/accelerated-mobile-pages/tags/1.0.96.1/templates/features.php#L7159Patch
• https://plugins.trac.wordpress.org/changeset/3123278/Patch
• https://wordpress.org/plugins/accelerated-mobile-pages/#developersProduct, Release Notes
• https://www.wordfence.com/threat-intel/vulnerabilities/id/b0a5fdb9-4e36-43ce-88ce-cd75bb1d1e25?source=cveThird Party Advisory

Published

Jul 24, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-6890Password reset tokens are generated using an insecure source…8.8
• CVE-2024-6891Attackers with a valid username and password can exploit a p…8.8
• CVE-2024-6892Attackers can craft a malicious link that once clicked will …6.1
• CVE-2024-6893The "soap_cgi.pyc" API handler allows the XML body of SOAP r…7.5
• CVE-2024-6894The RD Station plugin for WordPress is vulnerable to Stored …5.4
• CVE-2024-6895Insufficient authentication in user account management in Yu…6.1
• CVE-2024-6897The aThemes Starter Sites plugin for WordPress is vulnerable…6.4
• CVE-2024-6898A vulnerability was found in SourceCodester Record Managemen…9.8
• CVE-2024-6899A vulnerability was found in SourceCodester Record Managemen…9.8
• CVE-2024-6900A vulnerability was found in SourceCodester Record Managemen…8.8
• CVE-2024-6901A vulnerability classified as critical has been found in Sou…8.8
• CVE-2024-6902A vulnerability classified as critical was found in SourceCo…8.8