CVE-2026-13770 in AppMySite Plugin
Summary
by MITRE • 09/19/2026
The AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via save_ams_license_key AJAX Handler in all versions up to, and including, 3.15.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The save_ams_license_key AJAX handler performs no capability check and no nonce verification, meaning any authenticated user with Subscriber-level access or above can invoke it to store the malicious payload.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/19/2026
The AppMySite WordPress & WooCommerce Mobile App Builder plugin contains a critical security vulnerability affecting all versions up through 3.15.3. This flaw is classified as a Stored Cross-Site Scripting (XSS) issue located within the save_ams_license_key AJAX handler. The root cause of this vulnerability lies in insufficient input sanitization and output escaping mechanisms when processing data submitted via this specific endpoint. Because the malicious script is stored on the server, it persists until manually removed or overwritten, creating a persistent threat vector that affects not only the attacker but any user who subsequently views the compromised content.
From an authentication perspective, the vulnerability is particularly severe because it requires no elevated privileges to exploit. The save_ams_license_key AJAX handler fails to perform adequate capability checks and lacks nonce verification procedures. Consequently, any authenticated user with Subscriber-level access or higher can invoke this endpoint. In many WordPress installations, subscriber accounts are among the most common user roles, often granted by default for blog comments or basic site interactions. This low barrier to entry significantly increases the attack surface, allowing malicious actors who have obtained even minimal credentials to execute arbitrary web scripts within the context of other users' sessions.
The operational impact of this vulnerability is substantial and multifaceted. When a victim user accesses a page containing the injected script, the code executes in their browser with the same privileges as the logged-in session. This can lead to account takeover if the attacker crafts payloads that steal session cookies or authentication tokens. Furthermore, attackers can perform actions on behalf of the victim, such as modifying site settings, creating new administrative users, or exfiltrating sensitive data stored within the WordPress environment. The persistence of the payload means that every user visiting the affected page is potentially compromised until the vulnerability is patched and the malicious content is purged from the database.
This vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Specifically, it represents a stored variant where the payload is saved in server-side storage rather than being reflected directly in the HTTP response. In terms of offensive security frameworks, this exploit maps to MITRE ATT&CK technique T1059, Command and Scripting Interpreter, specifically JavaScript execution within a browser environment. It also relates to T1078, Valid Accounts, as it relies on legitimate but low-privilege credentials to gain initial access to the vulnerable endpoint.
To mitigate this risk, site administrators should immediately update the AppMySite plugin to version 3.15.4 or later, where these input validation and output escaping issues have been addressed by the developers. For sites that cannot be updated instantly due to compatibility concerns, implementing a Web Application Firewall (WAF) rule can help block requests targeting the save_ams_license_key endpoint with malicious payloads. Additionally, enforcing stricter role-based access controls for AJAX handlers is recommended as a defense-in-depth measure. Security audits should also review other custom AJAX endpoints within WordPress plugins to ensure they implement proper nonce verification and capability checks before processing user-supplied data.