CVE-2026-103421 in WPMobile.App Plugin
Summary
by MITRE • 10/03/2026
The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'REQUEST_URI (path segment after /android_json/search/)' parameter in all versions up to, and including, 11.84 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the app's content mode to be configured as 'webview' (i.e., the 'speed' option is not set to '1'), which is a supported and still-shipped mode, though no longer the default.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/03/2026
The WPMobile.App plugin for WordPress presents a significant security risk due to a stored cross-site scripting vulnerability affecting versions up to 11.84. This flaw resides within the REQUEST_URI parameter, specifically in the path segment following /android_json/search/. The root cause is insufficient input sanitization and output escaping when handling user-supplied data that is subsequently rendered into web pages. Because this is a stored vulnerability, malicious scripts are saved on the target server rather than being executed immediately via a crafted link. This persistence allows an unauthenticated attacker to inject arbitrary JavaScript code that will execute whenever any user accesses the affected page or triggers the search functionality associated with the vulnerable parameter.
The operational impact of this vulnerability extends beyond simple script execution. An attacker can leverage the injected scripts to perform session hijacking, steal sensitive cookies, deface websites, or redirect users to malicious sites. Since the exploitation does not require authentication, any visitor to a WordPress site running the affected plugin version is potentially at risk if they interact with the compromised search functionality. The severity of this impact is compounded by the fact that the vulnerability persists on the server side, meaning multiple victims can be targeted from a single injection point without further effort from the attacker.
Exploitation conditions are specific to the configuration of the app's content mode. The attack requires the speed option not to be set to 1, which corresponds to the webview content mode. While this is no longer the default setting in newer configurations, it remains a supported and shipped mode for many installations that have been customized or configured for legacy compatibility. This means that administrators who prioritize performance by disabling webviews are less likely to be affected, but those relying on traditional webview rendering remain vulnerable. The existence of this configuration option ensures that a substantial portion of the user base may still operate in an exploitable state if they do not actively monitor their settings or update the plugin.
From a technical classification perspective, this vulnerability aligns with CWE-79, which covers Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The stored nature of the attack also relates to CWE-83, where malicious data is persisted in an application's database or storage and later retrieved for display without proper validation. In terms of adversary tactics, this aligns with MITRE ATT&CK techniques involving injection attacks and potentially credential harvesting through session manipulation. Understanding these mappings helps security professionals categorize the risk accurately within their vulnerability management frameworks.
Mitigation strategies should focus on immediate remediation and long-term hardening. The primary recommendation is to update the WPMobile.App plugin to a version newer than 11.84, where this input sanitization flaw has been addressed by the developers. For organizations unable to patch immediately due to compatibility concerns, implementing Web Application Firewall rules can help detect and block requests containing malicious script payloads in the REQUEST_URI parameter. Additionally, administrators should review their configuration settings to ensure that if webview mode is not strictly necessary for their use case, they disable it or set the speed option appropriately to reduce the attack surface. Regular security audits of third-party WordPress plugins are essential to identify such vulnerabilities before they can be exploited by malicious actors targeting less secure installations.