VulnTitan VulnTitan Security command center
Plugin Vulnerability Hub
Plugin 7 known issues Latest disclosed May 01, 2026

App Builder – Create Native Android & iOS Apps On The Flight Vulnerabilities

Review known vulnerability records for the WordPress plugin App Builder – Create Native Android & iOS Apps On The Flight (`app-builder`), including severity, CVE references, affected versions, and patch status.

Recent tracked CVEs on this page include CVE-2026-7638, CVE-2026-2375 and CVE-2025-49989, so operators can jump from disclosure to patch validation without scanning the full feed first.

View on WordPress.org Back to Feed
Known Records
7
High or Critical
1
Patch Coverage
100%
Last Updated
May 01, 2026
Priority CVE Quick Links

Fast paths into App Builder – Create Native Android & iOS Apps On The Flight CVE reports

Start with the highest-signal CVE records for this WordPress plugin before scanning the full vulnerability feed.

Indexed CVEs
7
CVE-2024-9302 High 5.3.8
CVE-2024-9302 App Builder – Create Native Android & iOS Apps On The Flight Privilege Escalation

App Builder – Create Native Android & iOS Apps On The Flight <= 5.3.7 - Privilege Escalation and Account Takeover via Weak OTP

CVE-2026-2375 Medium No patch listed
CVE-2026-2375 App Builder – Create Native Android & iOS Apps On The Flight Privilege Escalation

App Builder – Create Native Android & iOS Apps On The Flight <= 5.5.10 - Unauthenticated Privilege Escalation via 'role' Parameter

CVE-2024-32565 Medium 3.8.9
CVE-2024-32565 App Builder – Create Native Android & iOS Apps On The Flight Stored Cross-Site Scripting

App Builder <= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

CVE-2024-7651 Medium 4.3.4
CVE-2024-7651 App Builder – Create Native Android & iOS Apps On The Flight SQL Injection

App Builder – Create Native Android & iOS Apps On The Flight <= 4.3.3 - Unauthenticated Limited SQL Injection via app-builder-search

CVE-2024-31282 Medium 3.8.8
CVE-2024-31282 App Builder – Create Native Android & iOS Apps On The Flight Vulnerability

App Builder <= 3.8.7 - Open Redirection

CVE-2026-7638 Medium No patch listed
CVE-2026-7638 App Builder – Create Native Android & iOS Apps On The Flight Authorization Bypass

App Builder <= 5.5.10 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Avatar Modification via 'user_id' Parameter

CVE-2025-49989 Medium 5.5.8
CVE-2025-49989 App Builder – Create Native Android & iOS Apps On The Flight Vulnerability

App Builder <= 5.5.7 - Missing Authorization

Coverage Snapshot

What this page helps you verify fast

This hub clusters every indexed record for App Builder – Create Native Android & iOS Apps On The Flight so operators can confirm whether a disclosed issue maps to the installed slug, version range, and patch path.

Patch Visibility
7 records include a published patch path, leaving 0 with no listed safe release yet.
Severity Mix
0 critical and 1 high severity finding.
Recent CVEs
CVE-2026-7638, CVE-2026-2375 and CVE-2025-49989
Reference Workflow
Jump from the hub into the full report when you need remediation notes, exploit context, CVSS vectors, or source references.
Triage First

Open the records most likely to drive action

These recent records surface the CVE strings, patch cues, and direct report links most operators need first.

Known Vulnerabilities

Reports for App Builder – Create Native Android & iOS Apps On The Flight

Sorted by latest disclosure date so newly published issues surface first.

Plugin Medium Patched: No CVE-2026-7638
CVE-2026-7638: App Builder <= 5.5.10 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Avatar Modification via 'user_id' Parameter

The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 5.6.0. This is due to missing authorization validation in the `upload_avatar()` function, which accepts an a...

Published
May 01, 2026
Patched Release
Not published
Affected Versions
Versions up to 5.6.0
Next Step
Open the full report for remediation notes and references.
Open CVE-2026-7638 Report Open CVE Reference
Plugin Medium Patched: No CVE-2026-2375
CVE-2026-2375: App Builder – Create Native Android & iOS Apps On The Flight <= 5.5.10 - Unauthenticated Privilege Escalation via 'role' Parameter

The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.5.10. This is due to the `verify_role()` function in `AuthTrails.php` explicitly whitelisting the `wcfm_vendor` role...

Published
Mar 20, 2026
Patched Release
Not published
Affected Versions
Versions up to 5.5.10
Next Step
Open the full report for remediation notes and references.
Open CVE-2026-2375 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-49989
CVE-2025-49989: App Builder <= 5.5.7 - Missing Authorization

The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 5.5.7. This makes it possible for unauthenticated attackers to perform...

Published
Jun 19, 2025
Patched Release
5.5.8
Affected Versions
Versions up to 5.5.7
Next Step
Update to 5.5.8 or newer if supported.
Open CVE-2025-49989 Report Open CVE Reference
Plugin High Patched: Yes CVE-2024-9302
CVE-2024-9302: App Builder – Create Native Android & iOS Apps On The Flight <= 5.3.7 - Privilege Escalation and Account Takeover via Weak OTP

The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.3.7. This is due to the verify_otp_forgot_password() and update_password() functions not having...

Published
Oct 24, 2024
Patched Release
5.3.8
Affected Versions
Versions up to 5.3.7
Next Step
Update to 5.3.8 or newer if supported.
Open CVE-2024-9302 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-7651
CVE-2024-7651: App Builder – Create Native Android & iOS Apps On The Flight <= 4.3.3 - Unauthenticated Limited SQL Injection via app-builder-search

The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to limited SQL Injection via the ‘app-builder-search’ parameter in all versions up to, and including, 4.2.6 due to insufficient escaping on the user supplied parameter and lack of...

Published
Aug 20, 2024
Patched Release
4.3.4
Affected Versions
Versions up to 4.3.3
Next Step
Update to 4.3.4 or newer if supported.
Open CVE-2024-7651 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-32565
CVE-2024-32565: App Builder <= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 3.8.8 due to insufficient input sanitization and output escaping on user supplied at...

Published
Apr 16, 2024
Patched Release
3.8.9
Affected Versions
Versions up to 3.8.8
Next Step
Update to 3.8.9 or newer if supported.
Open CVE-2024-32565 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-31282
CVE-2024-31282: App Builder <= 3.8.7 - Open Redirection

The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 3.8.7. This is due to insufficient validation on the redirect url supplied via the 'url' parameter. This makes it possible fo...

Published
Apr 05, 2024
Patched Release
3.8.8
Affected Versions
Versions up to 3.8.7
Next Step
Update to 3.8.8 or newer if supported.
Open CVE-2024-31282 Report Open CVE Reference