AppMySite WordPress Plugin CVE-2026-13770

Requires an authenticated WordPress account at Subscriber level or above (realistic where self-service registration or WooCommerce customer signup is enabled). The attacker calls the save_ams_license_key AJAX handler, which performs no current_user_can capability check and no nonce verification, allowing any such user to store the payload. For impact, a higher-privileged user must subsequently load the AMS home admin page (ams-home.php) where the unsanitized value is output, at which point the stored script executes in that user's browser. Limiting factors: valid low-privilege authentication is mandatory (not unauthenticated), the AppMySite plugin (versions <=3.15.3) must be installed and active, and realizing meaningful escalation depends on an administrator viewing the injected page.

This is a genuine-but-moderate authenticated stored XSS. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N = 6.4 Medium) is internally consistent with the description: network-reachable AJAX endpoint, low complexity, low-privilege (Subscriber, PR:L) attacker, scope change (S:C) because injected script executes in another user's browser session, and low confidentiality/integrity impact typical of client-side script injection. No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so exploitation status is 'no public exploit identified at time of analysis' - this is not a confirmed-exploited priority. The real-world risk is bounded by two factors the raw score does not fully convey: the attacker must already hold a valid authenticated account (viable where open/self-service registration is enabled, common on WooCommerce storefronts), and a higher-privileged victim (e.g. an administrator) must subsequently view the injected page for the payload to matter. Where those hold, a Subscriber can escalate toward admin-session compromise via script execution; where registration is closed, exploitability drops sharply. No signals conflict; the main gap is the absence of EPSS/KEV/POC data, which suggests opportunistic rather than mass exploitation.

An attacker registers or obtains a Subscriber-level account on a WordPress/WooCommerce site running AppMySite <=3.15.3, then invokes the save_ams_license_key AJAX action - which enforces neither a capability check nor a nonce - to store a malicious JavaScript payload in the AMS license/home settings. When an administrator later opens the AMS home page in wp-admin, the script executes in their authenticated session, enabling session/cookie theft or admin actions. No public exploit code is identified at time of analysis.