CVE-2026-13770

Name of the Vulnerable Software and Affected Versions AppMySite – WordPress & WooCommerce Mobile App Builder versions prior to 3.15.4

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with Subscriber-level access and above can inject arbitrary web scripts into pages that execute when accessed by other users. This is possible because the save ams license key AJAX handler lacks capability checks and nonce verification, allowing any authenticated user with the required access level to store a malicious payload.

Recommendations Update AppMySite – WordPress & WooCommerce Mobile App Builder to version 3.15.4 or later.