HighCVSS 8.1
EPSS 0.37%
Unauthenticated Privilege Escalation in MStore API <= 4.20.0 versions.
Product
FluxBuilder MStore API vulnerabilities
5 published CVES affecting FluxBuilder MStore API, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 5
- Critical
- 1
- High
- 1
- Medium
- 3
- Low
- 0
- Unscored
- 0
- CISA KEV
- 0
Latest FluxBuilder MStore API CVEs
Newest publication first
-
-
CVE-2026-57375 WordPress MStore API plugin <= 4.18.4 - Broken Access Control vulnerability
PublishedMediumCVSS 6.5 EPSS 0.27%Missing Authorization vulnerability in FluxBuilder MStore API mstore-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MStore API: from n/a through <= 4.18.4.
-
CVE-2026-54817 WordPress MStore API plugin <= 4.18.4 - Broken Authentication vulnerability
PublishedMediumCVSS 6.5 EPSS 0.25%Authentication Bypass Using an Alternate Path or Channel vulnerability in FluxBuilder MStore API allows Password Recovery Exploitation. This issue affects MStore API: from n/a through 4.18.4.
-
MediumCVSS 6.5 EPSS 0.38%
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 4.15.3. This is due to the plugin not checking that user registration is enabled prior to creating a user acco...
-
CriticalCVSS 9.8 EPSS 0.67%
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.14.7. This is due to insufficient verification on the 'phone' parameter of the 'firebase_sms_login' and 'firebase_sms...
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.