WordPress plugin
App Builder – Create Native Android & iOS Apps On The Flight security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical0
- High1
- Medium7
- Low0
All App Builder – Create Native Android & iOS Apps On The Flight vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium5.3 | 5.7.0 - Missing Authorization 3.8.4 – 5.7.0Update to 5.7.1 | CVE-2026-94294 | |
| Medium5.3 | Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Avatar Modification via 'user_id' Parameter ≤5.6.1Update to 5.7.0 | CVE-2026-7638 | |
| Medium6.5 | Unauthenticated Privilege Escalation via 'role' Parameter ≤5.5.10No patch available | CVE-2026-2375 | |
| Medium5.3 | Missing Authorization ≤5.5.7Update to 5.5.8 | CVE-2025-49989 | |
| High8.1 | Privilege Escalation and Account Takeover via Weak OTP ≤5.3.7Update to 5.3.8 | CVE-2024-9302 | |
| Medium5.6 | Unauthenticated Limited SQL Injection via app-builder-search ≤4.3.3Update to 4.3.4 | CVE-2024-7651 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤3.8.8Update to 3.8.9 | CVE-2024-32565 | |
| Medium5.4 | Open Redirection ≤3.8.7Update to 3.8.8 | CVE-2024-31282 |
- Medium5.35.7.0 - Missing Authorization
3.8.4 – 5.7.0Update to 5.7.1
- Medium5.3Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Avatar Modification via 'user_id' Parameter
≤5.6.1Update to 5.7.0
- Medium6.5Unauthenticated Privilege Escalation via 'role' Parameter
≤5.5.10No patch available
- Medium5.3Missing Authorization
≤5.5.7Update to 5.5.8
- High8.1Privilege Escalation and Account Takeover via Weak OTP
≤5.3.7Update to 5.3.8
- Medium5.6Unauthenticated Limited SQL Injection via app-builder-search
≤4.3.3Update to 4.3.4
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤3.8.8Update to 3.8.9
- Medium5.4Open Redirection
≤3.8.7Update to 3.8.8
App Builder – Create Native Android & iOS Apps On The Flight: common questions
Does App Builder – Create Native Android & iOS Apps On The Flight have known vulnerabilities?
Yes. VulnCrest Radar lists 8 known vulnerabilities in App Builder – Create Native Android & iOS Apps On The Flight: 1 high, 7 medium. At least one is not fixed in the latest version.
How do I check which version of App Builder – Create Native Android & iOS Apps On The Flight I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent App Builder – Create Native Android & iOS Apps On The Flight vulnerability?
CVE-2026-94294, published Oct 16, 2026: App Builder 3.8.4 - 5.7.0 - Missing Authorization. Severity: Medium (CVSS 5.3).
Is any App Builder – Create Native Android & iOS Apps On The Flight vulnerability listed in CISA KEV?
No. None of the known App Builder – Create Native Android & iOS Apps On The Flight vulnerabilities is currently listed in the CISA KEV catalog.