VulnTitan VulnTitan Security command center
Plugin Vulnerability Hub
Plugin 29 known issues Latest disclosed Apr 08, 2026

MStore API – Create Native Android & iOS Apps On The Cloud Vulnerabilities

Review known vulnerability records for the WordPress plugin MStore API – Create Native Android & iOS Apps On The Cloud (`mstore-api`), including severity, CVE references, affected versions, and patch status.

Recent tracked CVEs on this page include CVE-2026-3568, CVE-2025-4683 and CVE-2025-3438, so operators can jump from disclosure to patch validation without scanning the full feed first.

View on WordPress.org Back to Feed
Known Records
29
High or Critical
15
Patch Coverage
100%
Last Updated
Apr 09, 2026
Priority CVE Quick Links

Fast paths into MStore API – Create Native Android & iOS Apps On The Cloud CVE reports

Start with the highest-signal CVE records for this WordPress plugin before scanning the full vulnerability feed.

Indexed CVEs
28
CVE-2024-6328 Critical 4.15.0
CVE-2024-6328 MStore API – Create Native Android & iOS Apps On The Cloud Vulnerability

MStore API – Create Native Android & iOS Apps On The Cloud <= 4.14.7 - Authentication Bypass

CVE-2023-3197 Critical 4.0.2
CVE-2023-3197 MStore API – Create Native Android & iOS Apps On The Cloud SQL Injection

MStore API <= 4.0.1 - Unauthenticated SQL Injection

CVE-2023-3077 Critical 3.9.8
CVE-2023-3077 MStore API – Create Native Android & iOS Apps On The Cloud SQL Injection

MStore API <= 3.9.7 - Unauthenticated SQL Injection

CVE-2023-3277 Critical 4.10.8
CVE-2023-3277 MStore API – Create Native Android & iOS Apps On The Cloud Privilege Escalation

MStore API <= 4.10.7 - Unauthorized Account Access and Privilege Escalation

CVE-2022-47614 Critical 3.9.8
CVE-2022-47614 MStore API – Create Native Android & iOS Apps On The Cloud SQL Injection

MStore API <= 3.9.7 - Unauthenticated SQL Injection

CVE-2023-3076 Critical 3.9.9
CVE-2023-3076 MStore API – Create Native Android & iOS Apps On The Cloud Privilege Escalation

MStore API <= 3.9.8 - Unauthenticated Privilege Escalation

CVE-2023-2732 Critical 3.9.3
CVE-2023-2732 MStore API – Create Native Android & iOS Apps On The Cloud Vulnerability

MStore API <= 3.9.2 - Authentication Bypass

CVE-2023-2734 Critical 3.9.2
CVE-2023-2734 MStore API – Create Native Android & iOS Apps On The Cloud Vulnerability

MStore API <= 3.9.1 - Authentication Bypass

Coverage Snapshot

What this page helps you verify fast

This hub clusters every indexed record for MStore API – Create Native Android & iOS Apps On The Cloud so operators can confirm whether a disclosed issue maps to the installed slug, version range, and patch path.

Patch Visibility
29 records include a published patch path, leaving 0 with no listed safe release yet.
Severity Mix
12 critical and 3 high severity findings.
Recent CVEs
CVE-2026-3568, CVE-2025-4683 and CVE-2025-3438
Reference Workflow
Jump from the hub into the full report when you need remediation notes, exploit context, CVSS vectors, or source references.
Triage First

Open the records most likely to drive action

These recent records surface the CVE strings, patch cues, and direct report links most operators need first.

Known Vulnerabilities

Reports for MStore API – Create Native Android & iOS Apps On The Cloud

Sorted by latest disclosure date so newly published issues surface first.

Plugin Medium Patched: Yes CVE-2026-3568
CVE-2026-3568: MStore API <= 4.18.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Meta Update

The MStore API plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.18.3. This is due to the update_user_profile() function in controllers/flutter-user.php processing the 'meta_data' JSON parameter without any allowlist, b...

Published
Apr 08, 2026
Patched Release
4.18.4
Affected Versions
Versions up to 4.18.3
Next Step
Update to 4.18.4 or newer if supported.
Open CVE-2026-3568 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-4683
CVE-2025-4683: MStore API – Create Native Android & iOS Apps On The Cloud <= 4.17.5 - Missing Authorization to Authenticated (Subscriber+) Posts Creation

The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the create_blog function in all versions up to, and including, 4.17.5. This makes it possible for authentica...

Published
May 26, 2025
Patched Release
4.17.6
Affected Versions
Versions up to 4.17.5
Next Step
Update to 4.17.6 or newer if supported.
Open CVE-2025-4683 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-3438
CVE-2025-3438: MStore API – Create Native Android & iOS Apps On The Cloud <= 4.17.4 - Unauthenticated Limited Privilege Escalation

The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and including, 4.17.4. This is due to a lack of restriction of role when registering. This makes it possible for unauthenticate...

Published
May 01, 2025
Patched Release
4.17.5
Affected Versions
Versions up to 4.17.4
Next Step
Update to 4.17.5 or newer if supported.
Open CVE-2025-3438 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-12042
CVE-2024-12042: MStore API – Create Native Android & iOS Apps On The Cloud <= 4.16.4 - Authenticated (Subscriber+) HTML File Upload (Stored Cross-Site Scripting)

The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the profile picture upload functionality in all versions up to, and including, 4.16.4 due to insufficient file type validation. This makes it possi...

Published
Dec 12, 2024
Patched Release
4.16.5
Affected Versions
Versions up to 4.16.4
Next Step
Update to 4.16.5 or newer if supported.
Open CVE-2024-12042 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-11179
CVE-2024-11179: MStore API <= 4.15.7 - Authenticated (Subscriber+) SQL Injection

The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to SQL Injection via the 'status_type' parameter in all versions up to, and including, 4.15.7 due to insufficient escaping on the user supplied parameter and lack of sufficient prepa...

Published
Nov 19, 2024
Patched Release
4.15.8
Affected Versions
Versions up to 4.15.7
Next Step
Update to 4.15.8 or newer if supported.
Open CVE-2024-11179 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-8242
CVE-2024-8242: MStore API – Create Native Android & iOS Apps On The Cloud <= 4.15.3 - Authenticated (Subscriber+) Limited Arbitrary File Upload

The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the update_user_profile() function in all versions up to, and including, 4.15.3. This makes it possible for authentic...

Published
Sep 12, 2024
Patched Release
4.15.4
Affected Versions
Versions up to 4.15.3
Next Step
Update to 4.15.4 or newer if supported.
Open CVE-2024-8242 Report Open CVE Reference
Plugin High Patched: Yes CVE-2024-8269
CVE-2024-8269: MStore API – Create Native Android & iOS Apps On The Cloud <= 4.15.3 - Unauthorized User Registration

The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 4.15.3. This is due to the plugin not checking that user registration is enabled prior to creating a user acco...

Published
Sep 12, 2024
Patched Release
4.15.4
Affected Versions
Versions up to 4.15.3
Next Step
Update to 4.15.4 or newer if supported.
Open CVE-2024-8269 Report Open CVE Reference
Plugin High Patched: Yes CVE-2024-7628
CVE-2024-7628: MStore API – Create Native Android & iOS Apps On The Cloud <= 4.15.2 - Authentication Bypass to Account Takeover

The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 4.15.2. This is due to the use of loose comparison in the 'verify_id_token' function. This makes it possible for unauthenti...

Published
Aug 14, 2024
Patched Release
4.15.3
Affected Versions
Versions up to 4.15.2
Next Step
Update to 4.15.3 or newer if supported.
Open CVE-2024-7628 Report Open CVE Reference
Plugin Critical Patched: Yes CVE-2024-6328
CVE-2024-6328: MStore API – Create Native Android & iOS Apps On The Cloud <= 4.14.7 - Authentication Bypass

The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.14.7. This is due to insufficient verification on the 'phone' parameter of the 'firebase_sms_login' and 'firebase_sms...

Published
Jul 11, 2024
Patched Release
4.15.0
Affected Versions
Versions up to 4.14.7
Next Step
Update to 4.15.0 or newer if supported.
Open CVE-2024-6328 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2023-50878
CVE-2023-50878: MStore API <= 4.10.1 - Cross-Site Request Forgery

The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to 4.10.2 (exclusive). This is due to missing or incorrect nonce validation in the templates/admin/mstore-api-admin-dashboard.php file. This makes it possible for unauthenticated at...

Published
Dec 26, 2023
Patched Release
4.10.2
Affected Versions
Versions up to 4.10.1
Next Step
Update to 4.10.2 or newer if supported.
Open CVE-2023-50878 Report Open CVE Reference
Plugin High Patched: Yes CVE-2023-45055
CVE-2023-45055: MStore API <= 4.0.6 - Authenticated (Subscriber+) SQL Injection

The MStore API plugin for WordPress is vulnerable to SQL Injection via the $name and $search variables in versions up to, and including, 4.0.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it p...

Published
Oct 03, 2023
Patched Release
4.0.7
Affected Versions
Versions up to 4.0.6
Next Step
Update to 4.0.7 or newer if supported.
Open CVE-2023-45055 Report Open CVE Reference
Plugin Critical Patched: Yes CVE-2023-3197
CVE-2023-3197: MStore API <= 4.0.1 - Unauthenticated SQL Injection

The MStore API plugin for WordPress is vulnerable to Unauthenticated Blind SQL Injection via the 'id' parameter in versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL query. This...

Published
Jun 23, 2023
Patched Release
4.0.2
Affected Versions
Versions up to 4.0.1
Next Step
Update to 4.0.2 or newer if supported.
Open CVE-2023-3197 Report Open CVE Reference