Description

The AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via save_ams_license_key AJAX Handler in all versions up to, and including, 3.15.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The save_ams_license_key AJAX handler performs no capability check and no nonce verification, meaning any authenticated user with Subscriber-level access or above can invoke it to store the malicious payload.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-19T08:16:52.333Z",
  "pubdate": "2026-09-19T08:16:52.333Z",
  "executiveSummary": "The AppMySite – WordPress & WooCommerce Mobile App Builder plugin, in versions up to and including 3.15.3, contains a Stored Cross-Site Scripting (XSS) vulnerability. This security flaw originates from the failure to implement adequate input sanitization and output escaping within the save_ams_license_key AJAX handler.\nThe vulnerability allows authenticated users with Subscriber-level access or higher to inject arbitrary JavaScript payloads into the WordPress database. Because the affected AJAX handler lacks both capability checks and nonce validation, it is susceptible to unauthorized invocation by any authenticated user.\nWhen a victim, such as an administrator, accesses a page where the malicious script has been stored, the payload executes within the context of the victim's session. This facilitates unauthorized actions, including the potential theft of session cookies, administrative account takeover, or the redirection of users to malicious external domains. Given the nature of Stored XSS, this vulnerability poses a significant risk to the integrity and confidentiality of the WordPress environment, as attackers can leverage the elevated privileges of higher-privileged users to achieve full site compromise.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of user-supplied data within the save_ams_license_key AJAX handler. The function fails to sanitize incoming parameters before persistence in the WordPress options table and subsequently fails to escape the stored data during output.\nThe attack vector involves a crafted HTTP request targeted at the WordPress admin-ajax.php endpoint. An attacker authenticated as a subscriber can send a request to the save_ams_license_key action. Since the plugin developer omitted nonce verification (wp_verify_nonce) and capability checks (current_user_can), the backend processes the input without verifying the authorization status or the legitimacy of the request source.\nThe attack flow follows these steps: 1) The attacker identifies the target endpoint (admin-ajax.php?action=save_ams_license_key). 2) The attacker constructs a malicious payload containing an XSS vector, such as <script>alert('XSS')</script>, and includes it as a parameter in the request. 3) The application receives the payload and writes it directly into the site's options database without filtering. 4) The injected script is persisted globally. 5) Whenever a user or administrator navigates to a dashboard or page that renders the stored license key, the browser interprets the malicious string as active script content.\nBecause the payload is stored persistently in the database, the impact is not limited to the attacker; the script executes whenever any user views the compromised page. This can lead to the exfiltration of sensitive information, such as CSRF tokens or session identifiers, which an attacker can then use to perform unauthorized administrative operations. The lack of input sanitization makes this a classic case of Stored XSS, where the application's failure to enforce input validation on a sensitive server-side handler allows for the execution of arbitrary code in the context of other users' browsers. The absence of security headers or proper sanitization libraries exacerbates the severity of the flaw, as the application assumes that input received via the AJAX handler is inherently trusted."
}