WPMobile.App CVE-2026-103421

Exploitation requires the WPMobile.App plugin's content mode to be configured as 'webview' - specifically the 'speed' option must NOT be set to '1'. This is a supported and still-shipped mode but is no longer the default, which materially limits the exploitable population. The injection point is the path segment after /android_json/search/ (the REQUEST_URI parameter), and no authentication is required (PR:N). The payload is stored and executes when any user later accesses the injected page, so the practical limiting factors are (1) the site must run webview mode rather than the default, and (2) a legitimate user must subsequently load the affected page for the script to fire - consistent with the High attack complexity.

This is a moderate-severity Stored XSS (CWE-79) carrying a CVSS 5.4 (Medium) with vector AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N. The signals point to a real but conditional issue rather than a top-tier emergency. On the elevating side: the attack is network-reachable and unauthenticated (PR:N), requires no victim interaction as scored (UI:N), and causes a scope change (S:C) because injected script executes in the context of users browsing the page. On the de-escalating side: attack complexity is High (AC:H), confidentiality and integrity impact are only Low, and there is no availability impact. Critically, exploitation is gated on a non-default configuration - the app's content mode must be set to 'webview' (the 'speed' option not equal to '1') - which narrows the realistically exploitable population. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence set, so there is no evidence of active exploitation or weaponization; exploitation status is 'no public exploit identified at time of analysis.' The AC:H rating is consistent with the required non-default webview mode. Net: a legitimate patch-worthy flaw for affected sites running webview mode, but not a drop-everything priority given the Medium score, Low impacts, and configuration gating.

An unauthenticated attacker crafts a malicious request whose path segment after /android_json/search/ carries a JavaScript payload, which the plugin stores and later renders without proper sanitization or output escaping. When a legitimate user subsequently loads the affected page in a site configured for 'webview' content mode, the stored script executes in their session context. No public exploit code was identified at the time of analysis; the attack's High complexity reflects the dependency on the non-default webview configuration.