Kevin Whelan

**Name of the Vulnerable Software and Affected Versions** WPMobile.App – Android and iOS App Builder versions prior to 11.85 **Description** Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user accesses them. This issue affects the `REQUEST URI` (specifically the path segment after `/android json/search/`) endpoint. Exploitation is possible when the app's content mode is configured as 'webview', which occurs when the `speed` option is not set to '1'. **Recommendations** Update to version 11.85 or later. As a temporary mitigation, set the `speed` option to '1' to disable 'webview' content mode.