FluxBuilder vulnerabilities

Products

• MStore API 5
• ListApp Mobile Manager 1

Latest FluxBuilder CVEs

Newest publication first

1. CVE-2026-27543 WordPress MStore API plugin <= 4.20.0 - Privilege Escalation vulnerability

   Published 2026-08-13

   High·CVSS 8.1 EPSS 0.37%

   Unauthenticated Privilege Escalation in MStore API <= 4.20.0 versions.

2. CVE-2026-57375 WordPress MStore API plugin <= 4.18.4 - Broken Access Control vulnerability

   Published 2026-07-13

   Medium·CVSS 6.5 EPSS 0.27%

   Missing Authorization vulnerability in FluxBuilder MStore API mstore-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MStore API: from n/a through <= 4.18.4.

3. CVE-2026-54817 WordPress MStore API plugin <= 4.18.4 - Broken Authentication vulnerability

   Published 2026-06-17

   Medium·CVSS 6.5 EPSS 0.25%

   Authentication Bypass Using an Alternate Path or Channel vulnerability in FluxBuilder MStore API allows Password Recovery Exploitation. This issue affects MStore API: from n/a through 4.18.4.

4. CVE-2024-54295 WordPress ListApp Mobile Manager plugin <= 1.7.7 - Account Takeover vulnerability

   Published 2024-12-13

   Critical·CVSS 9.8 EPSS 0.75%

   Authentication Bypass Using an Alternate Path or Channel vulnerability in FluxBuilder ListApp Mobile Manager listapp-mobile-manager allows Authentication Bypass.This issue affects ListApp Mobile Manager: from n/a through <= 1.7.7.

5. CVE-2024-8269 MStore API – Create Native Android & iOS Apps On The Cloud <= 4.15.3 - Unauthorized User Registration

   Published 2024-09-13

   Medium·CVSS 6.5 EPSS 0.38%

   The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 4.15.3. This is due to the plugin not checking that user registration is enabled prior to creating a user acco...

6. CVE-2024-6328 MStore API – Create Native Android & iOS Apps On The Cloud <= 4.14.7 - Authentication Bypass

   Published 2024-07-12

   Critical·CVSS 9.8 EPSS 0.67%

   The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.14.7. This is due to insufficient verification on the 'phone' parameter of the 'firebase_sms_login' and 'firebase_sms...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.