CVE-2026-13770: AppMySite WordPress Plugin XSS Vulnerability

CVE-2026-13770 Overview

CVE-2026-13770 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the AppMySite – WordPress & WooCommerce Mobile App Builder plugin for WordPress. All versions up to and including 3.15.3 are affected. The flaw exists in the save_ams_license_key AJAX handler, which lacks both capability checks and nonce verification. Authenticated attackers with Subscriber-level access or higher can inject arbitrary JavaScript that executes when users load the affected admin pages.

Critical Impact
Any authenticated WordPress user, including low-privilege Subscribers, can store malicious scripts that execute in the context of privileged users viewing the plugin's admin pages.

Affected Products

AppMySite – WordPress & WooCommerce Mobile App Builder plugin
All versions up to and including 3.15.3
WordPress sites running the vulnerable plugin with Subscriber registration enabled

Discovery Timeline

2026-09-19 - CVE-2026-13770 published to NVD
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-13770

Vulnerability Analysis

The vulnerability resides in the save_ams_license_key AJAX handler registered by the AppMySite plugin. The handler accepts user-supplied license key data and stores it in the WordPress database without sanitization. When the plugin later renders this data in the ams-home.php view, it fails to escape the output, allowing stored HTML and JavaScript to execute in the browser of any user visiting the affected pages.

Two compounding weaknesses make exploitation trivial. First, the handler performs no current_user_can() capability check, so any authenticated session can invoke it. Second, no check_ajax_referer() or nonce verification is present, removing a common CSRF barrier. Combined, these gaps allow Subscriber-level users, who normally have no content-authoring rights on WordPress, to persist arbitrary scripts.

Root Cause

The root cause is a missing input sanitization and output escaping pair in the plugin's admin code paths at class-ams-admin-functions.php (lines 34 and 67) and ams-home.php (lines 125 and 222). The plugin trusts client-supplied license key input and reflects it directly into administrative views without applying WordPress escaping APIs such as esc_html(), esc_attr(), or wp_kses().

Attack Vector

An attacker registers or authenticates as a Subscriber on the target WordPress site. They then send a crafted POST request to /wp-admin/admin-ajax.php invoking the save_ams_license_key action with a JavaScript payload embedded in the license key parameter. The payload is stored persistently. When a site administrator opens the AppMySite plugin's home page, the script executes with the administrator's session, enabling session theft, backdoor account creation, or arbitrary administrative actions via the WordPress REST API.

No verified public exploit code is available. Refer to the Wordfence Vulnerability Analysis for additional technical context.

Detection Methods for CVE-2026-13770

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php containing action=save_ams_license_key originating from low-privilege user sessions.
Unexpected <script>, onerror=, or javascript: strings stored in WordPress options or plugin-specific database rows related to AppMySite license keys.
New administrator accounts, modified user roles, or unauthorized plugin installations occurring shortly after admin sessions viewed the plugin's home page.

Detection Strategies

Audit WordPress database entries associated with the AppMySite plugin for HTML tags or JavaScript event handlers in fields expected to contain alphanumeric license keys.
Review web server access logs for admin-ajax.php requests invoking save_ams_license_key and correlate with the requesting user's role.
Deploy a Web Application Firewall (WAF) rule that inspects the license key parameter for script tags, event handlers, and encoded payloads.

Monitoring Recommendations

Monitor creation of WordPress user accounts, especially with elevated roles, following administrator visits to the plugin's admin pages.
Track outbound HTTP requests from browsers loading the WordPress admin console to identify data exfiltration by injected scripts.
Enable and centralize WordPress audit logging to capture plugin option changes and AJAX action invocations.

How to Mitigate CVE-2026-13770

Immediate Actions Required

Update the AppMySite plugin to a version later than 3.15.3 once the vendor publishes a patched release.
Restrict Subscriber-level registration on public-facing WordPress sites where the plugin remains installed.
Audit existing plugin-related database entries for injected script payloads and remove any malicious content.
Rotate administrator credentials and invalidate active sessions if evidence of exploitation is found.

Patch Information

Review the WordPress Plugin Changeset for the vendor's remediation commit. Site owners should confirm the installed version is beyond 3.15.3 and that the save_ams_license_key handler now enforces both capability checks and nonce verification.

Workarounds

Disable or uninstall the AppMySite plugin until a fixed version is available.
Deploy a WAF rule blocking admin-ajax.php requests where the action parameter equals save_ams_license_key and the request body contains HTML control characters.
Enforce a Content Security Policy (CSP) on the WordPress admin console to restrict inline script execution.
Limit user registration to trusted roles and disable open Subscriber signup where operationally feasible.

bash

# Example WAF rule (ModSecurity syntax) blocking script payloads in the license key AJAX action
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
    "chain,phase:2,deny,status:403,id:1026137700,\
    msg:'Block CVE-2026-13770 AppMySite XSS attempt'"
    SecRule ARGS:action "@streq save_ams_license_key" \
        "chain"
        SecRule ARGS "@rx (?i)(<script|onerror=|onload=|javascript:)" "t:none,t:urlDecodeUni"