WordPress plugin
MStore API – Create Native Android & iOS Apps On The Cloud security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 39 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical14
- High3
- Medium22
- Low0
All MStore API – Create Native Android & iOS Apps On The Cloud vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Critical9.8 | Unauthenticated Authentication Bypass via 'id_token' Parameter JWT Forgery ≤4.20.0Update to 4.21.1 | CVE-2026-13447 | |
| Critical9.8 | Unauthenticated Privilege Escalation ≤4.20.0Update to 4.21.0 | CVE-2026-27543 | |
| High7.3 | Unauthorized User Registration ≤4.15.3Update to 4.15.4 | CVE-2024-8269 | |
| High8.1 | Authentication Bypass to Account Takeover ≤4.15.2Update to 4.15.3 | CVE-2024-7628 | |
| Critical9.8 | Authentication Bypass ≤4.14.7Update to 4.15.0 | CVE-2024-6328 | |
| High8.8 | Authenticated (Subscriber+) SQL Injection ≤4.0.6Update to 4.0.7 | CVE-2023-45055 | |
| Critical9.8 | Unauthenticated SQL Injection ≤4.0.1Update to 4.0.2 | CVE-2023-3197 | |
| Critical9.8 | Unauthenticated SQL Injection ≤3.9.7Update to 3.9.8 | CVE-2023-3077 | |
| Critical9.8 | Unauthorized Account Access and Privilege Escalation ≤4.10.7Update to 4.10.8 | CVE-2023-3277 | |
| Critical9.8 | Unauthenticated SQL Injection ≤3.9.7Update to 3.9.8 | CVE-2022-47614 | |
| Critical9.8 | Unauthenticated Privilege Escalation ≤3.9.8Update to 3.9.9 | CVE-2023-3076 | |
| Critical9.8 | Authentication Bypass ≤3.9.2Update to 3.9.3 | CVE-2023-2732 | |
| Critical9.8 | Authentication Bypass ≤3.9.1Update to 3.9.2 | CVE-2023-2734 | |
| Critical9.8 | Authentication Bypass ≤3.9.0Update to 3.9.1 | CVE-2023-2733 | |
| Critical9.8 | Arbitrary File Upload <3.4.5Update to 3.4.5 | — | |
| Critical9.8 | Authentication Bypass ≤3.1.9Update to 3.2.0 | CVE-2021-24148 | |
| Critical9.8 | Authentication Bypass <2.1.6Update to 2.1.6 | CVE-2020-36713 |
- Critical9.8Unauthenticated Authentication Bypass via 'id_token' Parameter JWT Forgery
≤4.20.0Update to 4.21.1
- Critical9.8Unauthenticated Privilege Escalation
≤4.20.0Update to 4.21.0
- High7.3Unauthorized User Registration
≤4.15.3Update to 4.15.4
- High8.1Authentication Bypass to Account Takeover
≤4.15.2Update to 4.15.3
- Critical9.8Authentication Bypass
≤4.14.7Update to 4.15.0
- High8.8Authenticated (Subscriber+) SQL Injection
≤4.0.6Update to 4.0.7
- Critical9.8Unauthenticated SQL Injection
≤4.0.1Update to 4.0.2
- Critical9.8Unauthenticated SQL Injection
≤3.9.7Update to 3.9.8
- Critical9.8Unauthorized Account Access and Privilege Escalation
≤4.10.7Update to 4.10.8
- Critical9.8Unauthenticated SQL Injection
≤3.9.7Update to 3.9.8
- Critical9.8Unauthenticated Privilege Escalation
≤3.9.8Update to 3.9.9
- Critical9.8Authentication Bypass
≤3.9.2Update to 3.9.3
- Critical9.8Authentication Bypass
≤3.9.1Update to 3.9.2
- Critical9.8Authentication Bypass
≤3.9.0Update to 3.9.1
- Critical9.8Arbitrary File Upload
<3.4.5Update to 3.4.5
- Critical9.8Authentication Bypass
≤3.1.9Update to 3.2.0
- Critical9.8Authentication Bypass
<2.1.6Update to 2.1.6
MStore API – Create Native Android & iOS Apps On The Cloud: common questions
Does MStore API – Create Native Android & iOS Apps On The Cloud have known vulnerabilities?
Yes. VulnCrest Radar lists 39 known vulnerabilities in MStore API – Create Native Android & iOS Apps On The Cloud: 14 critical, 3 high, 22 medium. None are known to affect version null.
How do I check which version of MStore API – Create Native Android & iOS Apps On The Cloud I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent MStore API – Create Native Android & iOS Apps On The Cloud vulnerability?
CVE-2026-97219, published Sep 30, 2026: MStore API 4.21.1 - 4.22.0 - Authenticated (Subscriber+) Payment Bypass. Severity: Medium (CVSS 4.3).
Is any MStore API – Create Native Android & iOS Apps On The Cloud vulnerability listed in CISA KEV?
No. None of the known MStore API – Create Native Android & iOS Apps On The Cloud vulnerabilities is currently listed in the CISA KEV catalog.