MStore API – Create Native Android & iOS Apps On The Cloud vulnerabilities

10 known vulnerabilities in MStore API – Create Native Android & iOS Apps On The Cloud from InspireUI. 10 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  MStore API – Create Native Android & iOS Apps…: Improper Authentication

  CVE-2026-13447Sep 5, 2026InspireUI

  The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verify_id_token() function, which de

• 7.3 High severity

  MStore API – Create Native Android & iOS Apps…: Improper Privilege Management

  CVE-2025-3438May 2, 2025InspireUI

  The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and including, 4.17.4. This is due to a lack of restriction of role when registering. This makes it possibl

• 8.8 High severity

  MStore API – Create Native Android & iOS Apps…: Unrestricted Upload of File with Dangerous Type

  CVE-2024-8242Sep 13, 2024InspireUI

  The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the update_user_profile() function in all versions up to, and including, 4.15.3. This makes it po

• 8.1 High severity

  MStore API – Create Native Android & iOS Apps…: Missing Authentication for Critical Functionality

  CVE-2024-7628Aug 15, 2024InspireUI

  The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 4.15.2. This is due to the use of loose comparison in the 'verify_id_token' function. This makes it pos

• 9.8 Critical severity

  MStore API – Create Native Android & iOS Apps…: Missing Authorization

  CVE-2024-6328Jul 12, 2024InspireUI

  The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.14.7. This is due to insufficient verification on the 'phone' parameter of the 'firebase_sms_logi

• 9.8 Critical severity

  MStore API – Create Native Android & iOS Apps…: Authentication Bypass Using an Alternate Path or Channel

  CVE-2023-3277Nov 3, 2023InspireUIEPSS 3.42%

  The MStore API plugin for WordPress is vulnerable to Unauthorized Account Access and Privilege Escalation in versions up to, and including, 4.10.7 due to improper implementation of the Apple login feature. This allows unauthenticated attackers to log in as any

• 9.8 Critical severity

  MStore API – Create Native Android & iOS Apps…: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2023-3197Jun 24, 2023InspireUIEPSS 3.87%

  The MStore API plugin for WordPress is vulnerable to Unauthenticated Blind SQL Injection via the 'id' parameter in versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the exist

• 9.8 Critical severity

  MStore API – Create Native Android & iOS Apps…: Authentication Bypass Using an Alternate Path or Channel

  CVE-2023-2734May 25, 2023InspireUIEPSS 3.81%

  The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.1. This is due to insufficient verification on the user being supplied during the cart sync from mobile REST API request through the plugin. This m

• 9.8 Critical severity

  MStore API – Create Native Android & iOS Apps…: Authentication Bypass Using an Alternate Path or Channel

  CVE-2023-2733May 25, 2023InspireUIEPSS 1.25%

  The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.0. This is due to insufficient verification on the user being supplied during the coupon redemption REST API request through the plugin. This makes

• 9.8 Critical severity

  MStore API – Create Native Android & iOS Apps…: Authentication Bypass Using an Alternate Path or Channel

  CVE-2023-2732May 25, 2023InspireUIEPSS 67.3%

  The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.2. This is due to insufficient verification on the user being supplied during the add listing REST API request through the plugin. This makes it po