CVE-2025-50053
Lifecycle Timeline
2Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nebelhorn Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App yournewsapp allows Reflected XSS.This issue affects Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App: from n/a through <= 0.8.8.8.
Analysis
Reflected Cross-site Scripting (XSS) in nebelhorn Blappsta Mobile App Plugin for WordPress affects versions through 0.8.8.8, allowing unauthenticated remote attackers to inject malicious scripts into web pages viewed by users. The vulnerability stems from improper input neutralization during page generation. With an EPSS score of 0.04% (14th percentile), exploitation likelihood is low, and no public exploit code or active exploitation has been identified at time of analysis.
Technical Context
This vulnerability represents a classic Reflected XSS flaw (CWE-79) in a WordPress plugin designed to generate native mobile app wrappers for iOS and Android applications. The plugin fails to properly sanitize or encode user-supplied input before rendering it into dynamically generated web pages. Reflected XSS occurs when untrusted data is echoed back to the user's browser without encoding, allowing attackers to craft malicious URLs containing JavaScript payloads that execute in the victim's session context. WordPress plugins are particularly sensitive to XSS given their role in content rendering and user interaction management.
Affected Products
The nebelhorn Blappsta Mobile App Plugin (also referenced as yournewsapp plugin) for WordPress is affected in versions from the initial release through version 0.8.8.8 inclusive. The plugin is distributed via the WordPress.org plugin repository as documented by the Patchstack vulnerability database.
Remediation
Update the Blappsta Mobile App Plugin to a version newer than 0.8.8.8. Users should navigate to their WordPress dashboard, go to Plugins > Installed Plugins, locate the yournewsapp (Blappsta Mobile App Plugin) entry, and click 'Update' if available, or disable and remove the plugin if updates are not available. Verify that the updated version properly sanitizes all user input using WordPress functions such as sanitize_text_field(), wp_kses_post(), or esc_attr() depending on context. Reference the Patchstack vulnerability database entry at https://patchstack.com/database/Wordpress/Plugin/yournewsapp/vulnerability/wordpress-blappsta-mobile-app-plugin-your-native-mobile-iphone-app-and-android-app-plugin-0-8-8-8-cross-site-scripting-xss-vulnerability?_s_id=cve for vendor guidance.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today