CVE-2026-13770

Received Received - Intake

Stored XSS in AppMySite WordPress Plugin via save_ams_license_key

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: Wordfence

Description

The AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via save_ams_license_key AJAX Handler in all versions up to, and including, 3.15.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The save_ams_license_key AJAX handler performs no capability check and no nonce verification, meaning any authenticated user with Subscriber-level access or above can invoke it to store the malicious payload.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-13770

Affected Vendors & Products

Vendor	Product	Version / Range
appmysite	wordpress_&_woocommerce_mobile_app_builder	to 3.15.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) issue in the AppMySite WordPress plugin. It allows authenticated attackers with Subscriber-level access or higher to inject malicious scripts via the save_ams_license_key AJAX handler. The plugin fails to sanitize input properly and lacks capability checks and nonce verification, enabling script execution when users access infected pages.

Detection Guidance

This vulnerability can be detected by checking for unauthorized script injections in WordPress pages or posts. Look for suspicious AJAX calls to save_ams_license_key without proper authentication. Review WordPress user roles for unauthorized Subscriber-level access or higher. Check plugin versions to confirm if the AppMySite plugin is version 3.15.3 or below.

Impact Analysis

An attacker could steal user sessions, redirect users to malicious sites, or deface your website. Since the payload is stored, it affects all visitors to the compromised page. The impact depends on user privileges but could lead to data theft or unauthorized actions on behalf of users.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements. For HIPAA, it may risk protected health information exposure. Compliance failures could result in fines or legal penalties depending on data processed.

Mitigation Strategies

Immediately update the AppMySite plugin to the latest version beyond 3.15.3. Remove or restrict Subscriber-level access to only trusted users. Implement nonce verification for AJAX handlers. Scan WordPress sites for injected scripts and remove any malicious payloads. Monitor for unauthorized changes to pages or posts.

Hi! I’m here to help you understand CVE-2026-13770. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70