VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

MStore API – Create Native Android & iOS Apps On The Cloud security & vulnerabilities

mstore-api— active installsLast vulnerability Sep 30, 2026

No known unpatched vulnerabilities in the latest version

All 39 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
39Known vulnerabilities
  • Critical14
  • High3
  • Medium22
  • Low0
Vulnerabilities per year
2020: 1 vulnerability1202021: 2 vulnerabilities2212023: 17 vulnerabilities17232024: 6 vulnerabilities6242025: 2 vulnerabilities2252026: 11 vulnerabilities1126

All MStore API – Create Native Android & iOS Apps On The Cloud vulnerabilities

MStore API – Create Native Android & iOS Apps On The Cloud vulnerabilities
SeverityVulnerabilityCVEPublished
Medium4.34.22.0 - Authenticated (Subscriber+) Payment Bypass
4.21.1 – 4.22.0Update to 4.22.1
CVE-2026-97219
Critical9.8Unauthenticated Authentication Bypass via 'id_token' Parameter JWT Forgery
≤4.20.0Update to 4.21.1
CVE-2026-13447
Medium4.3Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Completion
<4.21.1Update to 4.21.1
CVE-2026-18233
Medium6.3Missing Authorization
<4.21.1Update to 4.21.1
CVE-2026-18234
Critical9.8Unauthenticated Privilege Escalation
≤4.20.0Update to 4.21.0
CVE-2026-27543
Medium5.3Missing Authorization
≤4.20.0Update to 4.21.0
CVE-2026-16038
Medium4.3Insecure Direct Object Reference to Authenticated (Subscriber+) Order and Customer PII Disclosure
≤4.20.0Update to 4.21.0
CVE-2026-16039
Medium5.3Missing Authorization
≤4.20.0Update to 4.21.0
CVE-2026-16041
Medium5.3Missing Authorization
≤4.18.4Update to 4.19.0
CVE-2026-57375
Medium5.3Missing Authorization
≤4.18.4Update to 4.19.0
CVE-2026-54817
Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Meta Update
≤4.18.3Update to 4.18.4
CVE-2026-3568
Medium4.3Missing Authorization to Authenticated (Subscriber+) Posts Creation
≤4.17.5Update to 4.17.6
CVE-2025-4683
Medium6.5Unauthenticated Limited Privilege Escalation
≤4.17.4Update to 4.17.5
CVE-2025-3438
Medium5.4Authenticated (Subscriber+) HTML File Upload (Stored Cross-Site Scripting)
≤4.16.4Update to 4.16.5
CVE-2024-12042
Medium6.5Authenticated (Subscriber+) SQL Injection
≤4.15.7Update to 4.15.8
CVE-2024-11179
Medium4.3Authenticated (Subscriber+) Limited Arbitrary File Upload
≤4.15.3Update to 4.15.4
CVE-2024-8242
High7.3Unauthorized User Registration
≤4.15.3Update to 4.15.4
CVE-2024-8269
High8.1Authentication Bypass to Account Takeover
≤4.15.2Update to 4.15.3
CVE-2024-7628
Critical9.8Authentication Bypass
≤4.14.7Update to 4.15.0
CVE-2024-6328
Medium4.3Cross-Site Request Forgery
≤4.10.1Update to 4.10.2
CVE-2023-50878
High8.8Authenticated (Subscriber+) SQL Injection
≤4.0.6Update to 4.0.7
CVE-2023-45055
Critical9.8Unauthenticated SQL Injection
≤4.0.1Update to 4.0.2
CVE-2023-3197
Critical9.8Unauthenticated SQL Injection
≤3.9.7Update to 3.9.8
CVE-2023-3077
Critical9.8Unauthorized Account Access and Privilege Escalation
≤4.10.7Update to 4.10.8
CVE-2023-3277
Critical9.8Unauthenticated SQL Injection
≤3.9.7Update to 3.9.8
CVE-2022-47614
Critical9.8Unauthenticated Privilege Escalation
≤3.9.8Update to 3.9.9
CVE-2023-3076
Medium4.3Cross-Site Request Forgery to Order Title Update
≤3.9.6Update to 3.9.7
CVE-2023-3199
Medium4.3Cross-Site Request Forgery to Order Status Update
≤3.9.6Update to 3.9.7
CVE-2023-3198
Medium4.3Cross-Site Request Forgery to Order Title Update
≤3.9.6Update to 3.9.7
CVE-2023-3201
Medium4.3Cross-Site Request Forgery to Firebase Server Key Update
≤3.9.6Update to 3.9.7
CVE-2023-3202
Medium4.3Cross-Site Request Forgery to Product Limit Update
≤3.9.6Update to 3.9.7
CVE-2023-3203
Medium4.3Cross-Site Request Forgery to Order Message Update
≤3.9.6Update to 3.9.7
CVE-2023-3200
Medium6.5Missing Authorization
<3.9.7Update to 3.9.7
CVE-2023-3131
Critical9.8Authentication Bypass
≤3.9.2Update to 3.9.3
CVE-2023-2732
Critical9.8Authentication Bypass
≤3.9.1Update to 3.9.2
CVE-2023-2734
Critical9.8Authentication Bypass
≤3.9.0Update to 3.9.1
CVE-2023-2733
Critical9.8Arbitrary File Upload
<3.4.5Update to 3.4.5
—
Critical9.8Authentication Bypass
≤3.1.9Update to 3.2.0
CVE-2021-24148
Critical9.8Authentication Bypass
<2.1.6Update to 2.1.6
CVE-2020-36713

MStore API – Create Native Android & iOS Apps On The Cloud: common questions

Does MStore API – Create Native Android & iOS Apps On The Cloud have known vulnerabilities?

Yes. VulnCrest Radar lists 39 known vulnerabilities in MStore API – Create Native Android & iOS Apps On The Cloud: 14 critical, 3 high, 22 medium. None are known to affect version null.

How do I check which version of MStore API – Create Native Android & iOS Apps On The Cloud I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent MStore API – Create Native Android & iOS Apps On The Cloud vulnerability?

CVE-2026-97219, published Sep 30, 2026: MStore API 4.21.1 - 4.22.0 - Authenticated (Subscriber+) Payment Bypass. Severity: Medium (CVSS 4.3).

Is any MStore API – Create Native Android & iOS Apps On The Cloud vulnerability listed in CISA KEV?

No. None of the known MStore API – Create Native Android & iOS Apps On The Cloud vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?