CVE-2026-103421: WPMobile.App <= 11.84 - Unauthenticated Stored Cross-Site Scripting via '/android_json/search/<value>/0' Path Segment
The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'REQUESTURI (path segment after /androidjson/search/)' parameter in all versions up to, and including, 11.84 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the app's content mode to be configured as 'webview' (i.e., the 'speed' option is not set to '1'), which is a supported and still-shipped mode, though no longer the default.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Set the app content mode's 'speed' option to '1' so the app does not use the 'webview' mode required for exploitation.
WPMobile.App – Android and iOS App Builder speed = 1
Event History
Frequently Asked Questions
Which deployments are affected by the exploit condition?
Affected deployments are those running WPMobile.App version 11.84 or earlier with content mode configured as "webview," meaning the "speed" option is not set to "1." Webview remains supported and shipped, but it is no longer the default mode.
Does an attacker need an account or user interaction to inject the payload?
No account or prior privileges are required to inject the stored script. The payload executes when a user later accesses an injected page.
What is the practical impact if exploitation succeeds?
An attacker can store arbitrary web script through the path segment following /android_json/search/. The script can execute in the browser context of users who visit the affected injected page, with confidentiality and integrity impact rated low.