rootpwn

medium · CVSS v3 6.4 · EPSS 0.00201

CVE-2026-13770

The AppMySite plugin for WordPress is vulnerable to stored XSS via the save_ams_license_key AJAX handler. Authenticated users with Subscribe

Overview

The AppMySite plugin for WordPress is vulnerable to stored XSS via the save_ams_license_key AJAX handler. Authenticated users with Subscriber role or higher can inject scripts that execute for any user viewing the affected page. This allows attackers to steal credentials or deface the site.

Description

The AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via save_ams_license_key AJAX Handler in all versions up to, and including, 3.15.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The save_ams_license_key AJAX handler performs no capability check and no nonce verification, meaning any authenticated user with Subscriber-level access or above can invoke it to store the malicious payload.

Impact

Confidentiality: attackers can steal session cookies or personal data. Integrity: malicious scripts can modify page content or deface site. Availability: minimal direct impact but could degrade user experience. Impacted parties: site administrators, content editors, and end users who view affected pages.

Remediation

Update AppMySite to version 3.15.4 or later. If update not possible, disable the save_ams_license_key AJAX endpoint or restrict it to administrators only. Ensure WordPress core and all plugins are up to date. Use a web application firewall to block XSS payloads.

Risk context

The vulnerability has a medium severity score (CVSS 6.4) and a very low EPSS of 0.00201, indicating it is unlikely to be widely exploited at present, but defenders should still address it promptly to prevent potential XSS attacks.

Affected products

  • WordPress
  • AppMySite
  • WooCommerce

Scores

Severity
medium
CVSS v2
5.5
CVSS v3
6.4
CVSS v4
—
EPSS
0.00201

XSS WordPress StoredXSS Authentication WebSecurity Plugin Defacement

← All CVEs

Related CVEs

medium

CVE-2026-93956

A medium‑severity XSS flaw exists in olivier-ls PHP‑FTS up to 1.1.2. The vulnerability is triggered by manipulating the Query argument to SearchEngine::buildHighlights, allowing remote attackers to inject malicious scripts. It can be exploited via a web request to the affected component.

View analysis

medium

CVE-2026-93957

A vulnerability has been found in olivier-ls PHP-FTS up to 1.1.3. This affects the function SearchEngine::matchesSingleFilter of the file src/SearchEngine.php of the component Filter Matching. The manipulation leads to incorrect comparison. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.4 is able to mitigate this issue. The identifier of the patch is 0b2fae333d6b022da7ed4c43e2d41aa03f91dff3. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

View analysis

medium

CVE-2026-12402

The OTP Login & Register WooCommerce plugin for WordPress is vulnerable to stored XSS via the 'fb-config' setting. Authenticated administrators can inject scripts that execute for any user who views the affected page, enabling session hijacking or site defacement.

View analysis

medium

CVE-2026-13191

The Create plugin for WordPress (v2.5.3 and earlier) contains a SQL injection flaw in the order_by parameter that can be exploited by users with author-level or higher privileges. Attackers can inject arbitrary SQL to read sensitive database data. This vulnerability is exploitable via the REST API endpoint that defaults to publish_posts capability.

View analysis