CVE-2026-13770: AppMySite <= 3.15.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via save_ams_license_key AJAX Handler
The AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via saveamslicensekey AJAX Handler in all versions up to, and including, 3.15.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The saveamslicensekey AJAX handler performs no capability check and no nonce verification, meaning any authenticated user with Subscriber-level access or above can invoke it to store the malicious payload.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user with Subscriber-level access or higher can invoke the affected AJAX handler. The handler has no capability check or nonce verification.
What does an attacker need to do to exploit it?
The attacker needs a valid authenticated account at the Subscriber role or above and must submit a malicious script payload through the save_ams_license_key AJAX handler. No victim interaction is required to store the payload, but the script executes when someone later accesses an injected page.
Are installations running the affected plugin versions exposed by default?
The affected handler can be invoked by any authenticated Subscriber-level-or-higher user because it lacks both capability and nonce validation. Exposure therefore depends on whether untrusted or compromised users can authenticate to the WordPress site.
How can I assess whether my site may already be affected?
Review the stored AppMySite license-key-related value and pages where it is rendered for unexpected script content or HTML. Also review authenticated user accounts, especially Subscriber accounts, for unauthorized access because those accounts can invoke the vulnerable handler.