CVE-2024-6896
Published
CVSS v3
6.4
MEDIUM
CVSS v2
N/A
Affected
1
PROJECT
Description
The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.96.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
<p>AMP for WP automatically adds Accelerated Mobile Pages (Google AMP Project) functionality to your WordPress site. AMP makes your website faster for Mobile visitors.</p>
<p><a href="https://ampforwp.com/new/" rel="nofollow ugc">What’s New in this Version?</a> | <a href="https://ampforwp.com/priority-support/#utm_source=wp_org&utm_medium=description-tab-pro-box&utm_campaign=AMP%20Plugin" rel="nofollow ugc">Priority Support</a> | <a href="https://ampforwp.com/demo/" rel="nofollow ugc">View Demo</a> | <a href="https://wordpress.org/plugins/accelerated-mobile-pages/screenshots/" rel="ugc">Screenshots</a> | <a href="https://ampforwp.com/help-center/" rel="nofollow ugc">Community</a></p>
<p><strong>Extensions</strong><br />
Some useful extensions to extend AMP features, check <a href="https://ampforwp.com/advanced-amp-ads/#utm_source=wp_org&utm_medium=description-tab-pro-box&utm_campaign=AMP%20Plugin" rel="nofollow ugc">AMP Adsense Support</a>, <a href="https://ampforwp.com/contact-form-7/#utm_source=wp_org&utm_medium=description-tab-pro-box&utm_campaign=AMP%20Plugin" rel="nofollow ugc">Contact Form 7 Support</a>, <a href="https://ampforwp.com/opt-in-forms/#utm_source=wp_org&utm_medium=description-tab-pro-box&utm_campaign=AMP%20Plugin" rel="nofollow ugc">Email Opt-in Support</a> and <a href="https://ampforwp.com/call-to-action/#utm_source=wp_org&utm_medium=description-tab-pro-box&utm_campaign=AMP%20Plugin" rel="nofollow ugc">Call To Action Support</a>. To view more, go to our <a href="https://ampforwp.com/extensions/#utm_source=wp_org&utm_medium=description-tab-pro-box&utm_campaign=AMP%20Plugin" rel="nofollow ugc">Extensions page</a>.</p>
<p><strong>Support</strong><br />
We try our best to provide support on WordPress.org forums. However, We have a special <a href="https://ampforwp.com/help-center/" rel="nofollow ugc">community support</a> where you can ask us questions and get help about your AMP related questions. Delivering a good user experience means a lot to us and so we try our best to reply each and every question that gets asked.</p>
<p><strong>Bug Reports</strong><br />
Bug reports for AMP for WP are <a href="https://github.com/ahmedkaludi/Accelerated-Mobile-Pages" rel="nofollow ugc">welcomed on GitHub</a>. Please note GitHub is <em>not</em> a support forum, and issues that aren’t properly qualified as bugs will be closed.</p>
<h4>Features:</h4>
<ul>
<li>NEW – Gutenberg Support</li>
<li>NEW – Divi and Elementor Support <a href="https://ampforwp.com/amp-pagebuilder-compatibility/" rel="nofollow ugc">More Info</a></li>
<li>NEW – GDPR Compliance</li>
<li>NEW – Google PageSpeed Optimization with SSR (Server Side Rendering)</li>
<li>NEW – CSS Optimization (Tree Shaking) – This will automatically remove all the unused CSS from your AMP pages</li>
<li>NEW – Google Font API and Local Fonts Support For All Designs</li>
<li>Out of the box compatibility for Yoast SEO, All in One Seo, Rank Math, Genesis, SEOPress, Bridge Qode SEO, The SEO Framework, SmartCrawl and Squrilly SEO Plugin.</li>
<li>Introducing Page Builder 3.0 for AMP! <a href="https://ampforwp.com/tutorials/article/amp-page-builder-installation/" rel="nofollow ugc">Learn More & Video</a></li>
<li>New Default Theme for AMP called Swift</li>
<li>3 Pre-built AMP Layouts for Business websites and landing pages </li>
<li>OneSignal and TruePush Push Notifications integration </li>
<li>Advanced WooCommerce Support <a href="https://ampforwp.com/woocommerce/" rel="nofollow ugc">More Info</a></li>
<li>AMP Plugins Manager – Which allows you to disable a specific plugin functionality only in the AMP version</li>
<li>Structured Data Options</li>
<li>Page Break / NextPage (Pagination) Support</li>
<li>Contact Form 7 Support <a href="https://ampforwp.com/contact-form-7/" rel="nofollow ugc">More Info</a></li>
<li>Graviry Form Support <a href="https://ampforwp.com/gravity-forms/" rel="nofollow ugc">More Info</a></li>
<li>Caldera Form Support <a href="https://ampforwp.com/caldera-forms-for-amp/" rel="nofollow ugc">More Info</a></li>
<li>Ninja Form Support <a href="https://ampforwp.com/ninja-forms/" rel="nofollow ugc">More Info</a></li>
<li>Facebook Comments Support</li>
<li>Github Gist Support</li>
<li>Email Opt-in Subscription form support in AMP added</li>
<li>Call to Action boxes and notification bars </li>
<li>9 Advertisement sizes – 2 More AD slots added recently</li>
<li>Comments Forms in AMP.</li>
<li>Native AMP Search functionality.</li>
<li>Design 3 <a href="https://www.youtube.com/watch?v=ub1pwskt3Rc" rel="nofollow ugc">Watch the Video Overview</a></li>
<li>Disqus Comments Support</li>
<li>Vuukle Comments Support</li>
<li>Spot.IM Comments Support</li>
<li>Google Tag Manager Support</li>
<li>Page, Category & Tags Support Added</li>
<li>Custom AMP Editor – Which allows you to override your Content that you had written in Post or page, so you can add the different content just for AMP.</li>
<li>Mobile Redirection – More than 50% of your traffic is from mobile and you aren’t doing anything to improve their user experience, which means you are falling behind on SEO and it can result in lower SERPS. Lightning fast mobile version means faster User experience means more engagement which directly results in the lower bounce rate.</li>
<li>Custom Post Type Support </li>
<li>Custom Taxonomies Support</li>
<li>Star Ratings</li>
<li>Drag & Drop Page builder Added </li>
<li>4 Designs for AMP </li>
<li>AMP WooCommerce Support </li>
<li>Switch on/off Support for Pages & Posts on AMP</li>
<li>Translation Panel & RTL</li>
<li>Internal AMP linking – You can browse AMP pages internally</li>
<li>Related posts below the post</li>
<li>Recent Comments list</li>
<li>Automatically integrate AMP to your website.</li>
<li>Google Adsense (AMP-AD) Support with 6 different Ad slots across the layout! The First Plugin to have this capability.</li>
<li>Built in MGID Ads Support with 6 different ad slots.</li>
<li>Google Analytics Support.</li>
<li>User Friendly Theme Options Panel.</li>
<li>Unlimited Color Scheme.</li>
<li>Image Logo Upload.</li>
<li>Supports Posts and Pages and other custom post types.</li>
<li>Proper rel canonical tags which means that Google know the original page.</li>
<li>Overlay Navigation Menu bar.</li>
<li>Social Sharing in the Single.</li>
<li>Sexy Design.</li>
<li>Separate WordPress Menu for AMP version.</li>
<li>Page builder & Shortcodes Compatibility.</li>
<li>Carousel support for Gallery.</li>
<li>Better Image stretching and resizing.</li>
<li>Youtube Video Embed Support.</li>
<li>Vine Embed Support.</li>
<li>Twitter oembed Support.</li>
<li>Instagram Embed Support.</li>
<li>Facebook Video Embed Support.</li>
<li>RTL Support</li>
<li>Custom AMP FrontPage</li>
<li>Notifications</li>
<li>Alexa Metrics, Chartbeat, Hi-stats, Yandex Metrika, Piwik, Segment.com, StatCounter, Effective Measure and comScore Builtin Support</li>
<li>Incontent & DoubleClick Support</li>
<li>Great Support & Active Development.</li>
<li>Widgets & WooCommerce </li>
<li>Breadcrumb Support added </li>
<li>Facebook Instant Articles Support Added</li>
<li>AMP Installation Wizard that makes it easy to setup for new users.</li>
<li>Category base remover support</li>
<li>Tag base remover support</li>
<li>Addthis Sharing Support</li>
<li>Infinite Scroll Support</li>
<li>Photo Gallery by 10Web Support </li>
<li>12 New Social Media Integrations added (Reddit, Tumblr, Telegram, Digg, StumbleUpon, Wechat, Viber, Hatena Bookmarks, Pocket, Yummly, MeWe, Flipboard) </li>
<li>AMP Theme Framework Core Support Added. You can now create AMP templates of your own in just minutes. <strong><a href="https://ampforwp.com/amp-theme-framework/" rel="nofollow ugc">More</a></strong></li>
<li>NEW – Make AMP & Non-AMP Same with just one click! </li>
<li>NEW – Allows you to use AMP as primary website!</li>
</ul>
<p><strong><a href="https://ampforwp.com/community/" rel="nofollow ugc">JOIN CHAT GROUP COMMUNITY</a></strong>: Purpose of this group is to get proper suggestions and feedback from plugin users and the community so that we can make the plugin even better.</p>
<h4>Getting Started:</h4>
<p><strong><a href="https://ampforwp.com/help/" rel="nofollow ugc">1. User Documentation:</a></strong> The AMP for WordPress plugin is easy to setup but we have some tutorials and guides prepared for you which will help you dive deep with the plugin.</p>
<p><strong><a href="https://ampforwp.com/tutorials/article-categories/developer-documentation/" rel="nofollow ugc">2. Developer Docs:</a></strong> We have created special documentations for developers and semi technical users who are willing to modify the plugin according to their own needs.</p>
<p><strong><a href="https://ampforwp.com/help-center/" rel="nofollow ugc">3. Support:</a></strong> We try our best to provide support on WordPress.org forums. However, We have a special community support where you can ask us questions and get help about your AMP related questions. Delivering a good user experience means a lot to us and so we try our best to reply each and every question that gets asked.</p>
<p><strong><a href="https://ampforwp.com/priority-support/#utm_source=wp_org&utm_medium=description-tab-pro-box&utm_campaign=AMP%20Plugin" rel="nofollow ugc">4. Premium Support:</a></strong> We will personally take care that your website’s AMP version is perfectly validated. We will make sure that your AMP version gets approved and indexed by Google Webmaster Tools properly and we will even keep an eye on AMP updates from Google and implement them into your website.</p>
<h3>Credits</h3>
<p>Some code used in this plugin was forked from ‘AMP for WordPress’ plugin https://wordpress.org/plugins/amp/ – License URI: http://www.gnu.org/licenses/gpl-2.0.html.<br />
Mobile & Tablet detection library used https://github.com/serbanghita/Mobile-Detect – License URI: https://github.com/serbanghita/Mobile-Detect/blob/master/LICENSE.txt<br />
PHP CSS Parser library used https://github.com/sabberworm/PHP-CSS-Parser – License URI: https://github.com/sabberworm/PHP-CSS-Parser#license (PHP-CSS-Parser is freely distributable under the terms of an MIT-style license.)<br />
AMP Optimizer library used https://github.com/ampproject/amp-toolbox/tree/main/packages/optimizer – License URI: https://github.com/ampproject/amp-toolbox#license (AMP Toolbox is made by the AMP Project, and is licensed under the Apache License, Version 2.0.)<br />
GA4 Code used from https://github.com/analytics-debugger/google-analytics-4-for-amp – License URI: https://github.com/analytics-debugger/google-analytics-4-for-amp/blob/main/LICENSE</p>