CVE-2024-12042: MStore API – Create Native Android & iOS Apps On The Cloud <= 4.16.4 - Authenticated (Subscriber+) HTML File Upload (Stored Cross-Site Scripting)
Description
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the profile picture upload functionality in all versions up to, and including, 4.16.4 due to insufficient file type validation. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload HTML files with arbitrary web scripts that will execute whenever a user accesses the file.
Classification
CVE ID: CVE-2024-12042
CVSS Base Severity: MEDIUM
CVSS Base Score: 5.4
Affected Products
Vendor: inspireui
Product: MStore API – Create Native Android & iOS Apps On The Cloud
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.05% (probability of being exploited)
EPSS Percentile: 23.99% (scored less or equal to compared to others)
EPSS Date: 2025-02-04 (when was this score calculated)
References
https://www.wordfence.com/threat-intel/vulnerabilities/id/af468138-c10a-4f9b-b714-0425d52f0210?source=cvehttps://plugins.trac.wordpress.org/browser/mstore-api/trunk/functions/index.php#790
https://plugins.trac.wordpress.org/changeset/3205338/mstore-api/trunk/functions/index.php