WordPress Plugin Vulnerabilities

Accelerated Mobile Pages < 1.0.93 - Unautenticated Reflected Cross-Site Scripting

Description

The plugin is vulnerable to Reflected Cross-Site Scripting via the 'disqus_name' parameter due to insufficient input sanitization and output escaping on the executed JS file. T

Affects Plugins

Plugin icon
accelerated-mobile-pages
Fixed in 1.0.93

References

CVE
CVE-2024-0587
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/85ca96a6-7992-424b-8b88-9a0751925223

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
stealthcopter
Verified
No
WPVDB ID
b9948876-7cf6-4659-a997-a6755ff8c520

Timeline

Publicly Published
2024-01-22 (about 2 years ago)
Added
2024-01-24 (about 2 years ago)
Last Updated
2024-01-24 (about 2 years ago)

Other

Published
Title
Published
2025-09-22
Title
NGG Smart Image Search <= 3.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2023-03-15
Title
PB SEO Friendly Images <= 4.0.5 - Admin+ Stored XSS
Published
2023-05-12
Title
Donations Made Easy - Smart Donations <= 4.0.12 - Reflected XSS
Published
2022-11-17
Title
GetYourGuide Ticketing < 1.0.4 - Admin+ Stored XSS
Published
2026-02-06
Title
Bold Page Builder <= 5.5.3 - Authenticated (Author+) Stored DOM-based Cross-Site Scripting in Post Grid