Wpmobile App Android And Ios App Builder
Monthly
Unauthenticated attackers can hijack arbitrary WordPress accounts, including administrators, on sites running the WPMobile.App - Android and iOS App Builder plugin (wpappninja) in all versions up to and including 11.82, because a missing authorization check exposes password-reset URLs that the plugin's push queue has mirrored from outbound emails. The issue carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and the assessed vector matches the vendor listing; exploitation is contingent on the non-default mail-to-push setting (wpmobile_auto_mail=1) being enabled and on a password-reset email existing in the queue, which an attacker can induce through WordPress's standard lost-password flow. No CISA KEV entry and no public exploit code were identified at time of analysis, so the flaw is not confirmed as actively exploited, but the combination of unauthenticated reach, low complexity, and full account-takeover impact makes it high priority wherever the prerequisite configuration is in place.
Stored cross-site scripting in the WPMobile.App - Android and iOS App Builder plugin for WordPress (all versions up to and including 11.84) allows unauthenticated attackers to inject arbitrary JavaScript that is persisted and later executed in the browser of any user who opens the affected page. Exploitation is gated by configuration: the site's content mode must be set to 'webview' (i.e., the 'speed' option is not '1'), a still-supported but no longer default mode, and a victim must subsequently load the poisoned page, which is why the assessed vector carries High attack complexity and Scope Change (CVSS 5.4). At time of analysis no public exploit code has been identified and there is no indication of confirmed active exploitation (CISA KEV); the plugin's public source, however, makes the injection path independently reviewable.
Unauthenticated attackers can hijack arbitrary WordPress accounts, including administrators, on sites running the WPMobile.App - Android and iOS App Builder plugin (wpappninja) in all versions up to and including 11.82, because a missing authorization check exposes password-reset URLs that the plugin's push queue has mirrored from outbound emails. The issue carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and the assessed vector matches the vendor listing; exploitation is contingent on the non-default mail-to-push setting (wpmobile_auto_mail=1) being enabled and on a password-reset email existing in the queue, which an attacker can induce through WordPress's standard lost-password flow. No CISA KEV entry and no public exploit code were identified at time of analysis, so the flaw is not confirmed as actively exploited, but the combination of unauthenticated reach, low complexity, and full account-takeover impact makes it high priority wherever the prerequisite configuration is in place.
Stored cross-site scripting in the WPMobile.App - Android and iOS App Builder plugin for WordPress (all versions up to and including 11.84) allows unauthenticated attackers to inject arbitrary JavaScript that is persisted and later executed in the browser of any user who opens the affected page. Exploitation is gated by configuration: the site's content mode must be set to 'webview' (i.e., the 'speed' option is not '1'), a still-supported but no longer default mode, and a victim must subsequently load the poisoned page, which is why the assessed vector carries High attack complexity and Scope Change (CVSS 5.4). At time of analysis no public exploit code has been identified and there is no indication of confirmed active exploitation (CISA KEV); the plugin's public source, however, makes the injection path independently reviewable.