Appmysite Wordpress Woocommerce Mobile App Builder No Code Android Ios App Maker
Monthly
Stored cross-site scripting in the AppMySite - WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker) plugin, in all versions up to and including 3.15.3, lets any authenticated user with Subscriber-level access or above persist arbitrary JavaScript by invoking the plugin's save_ams_license_key AJAX handler, which enforces neither a capability check nor a nonce check. The injected script later runs in the browser of a higher-privileged user who loads the plugin's AMS home admin page, allowing the attacker to act in that user's session context. The CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) and no public exploit code was identified at time of analysis; this is a genuine but moderate authenticated stored XSS whose meaningful escalation depends on an administrator viewing the poisoned page.
Stored cross-site scripting in the AppMySite - WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker) plugin, in all versions up to and including 3.15.3, lets any authenticated user with Subscriber-level access or above persist arbitrary JavaScript by invoking the plugin's save_ams_license_key AJAX handler, which enforces neither a capability check nor a nonce check. The injected script later runs in the browser of a higher-privileged user who loads the plugin's AMS home admin page, allowing the attacker to act in that user's session context. The CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) and no public exploit code was identified at time of analysis; this is a genuine but moderate authenticated stored XSS whose meaningful escalation depends on an administrator viewing the poisoned page.