Plugin security history

MStore API – Create Native Android & iOS Apps On The Cloud Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 31 vulnerability records associated with MStore API – Create Native Android & iOS Apps On The Cloud, published between 2020 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

31Total records

12Critical

3High

16Medium

0Low

0Informational

31Patched records

0Currently marked unpatched

2020-03-11First disclosure

2026-07-07Latest disclosure

30 of 31CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2020	1	1 records
2021	2	2 records
2023	17	17 records
2024	6	6 records
2025	2	2 records
2026	3	3 records

Severity Breakdown

Severity	Records	Share
Critical	12	38.7%
High	3	9.7%
Medium	16	51.6%

Vulnerability-Type Breakdown

Authentication Bypass

8 records25.8%

First: 2020. Latest: 2024.

CSRF

7 records22.6%

First: 2023. Latest: 2023.

Missing Authorization

5 records16.1%

First: 2023. Latest: 2026.

SQL Injection

5 records16.1%

First: 2023. Latest: 2024.

Arbitrary File Upload

3 records9.7%

First: 2021. Latest: 2024.

Privilege Escalation

3 records9.7%

First: 2023. Latest: 2025.

Patch Status

Patched: 31
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

4.19.0
4.18.4
4.17.6
4.17.5
4.16.5
4.15.8
4.15.4
4.15.3
4.15.0
4.10.2
4.0.7
4.0.2
3.9.9
3.9.8
4.10.8
3.9.7
3.9.3
3.9.2
3.9.1
3.4.5
3.2.0
2.1.6

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-4.18.4`	MStore API – Create Native Android & iOS Apps On The Cloud <= 4.18.4 - Missing Authorization	July 7, 2026	4.19.0	Medium
`*-4.18.4`	MStore API – Create Native Android & iOS Apps On The Cloud <= 4.18.4 - Missing Authorization	June 17, 2026	4.19.0	Medium
`*-4.18.3`	MStore API <= 4.18.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Meta Update	April 8, 2026	4.18.4	Medium
`*-4.17.5`	MStore API – Create Native Android & iOS Apps On The Cloud <= 4.17.5 - Missing Authorization to Authenticated (Subscriber+) Posts Creation	May 26, 2025	4.17.6	Medium
`*-4.17.4`	MStore API – Create Native Android & iOS Apps On The Cloud <= 4.17.4 - Unauthenticated Limited Privilege Escalation	May 1, 2025	4.17.5	Medium
`*-4.16.4`	MStore API – Create Native Android & iOS Apps On The Cloud <= 4.16.4 - Authenticated (Subscriber+) HTML File Upload (Stored Cross-Site Scripting)	December 12, 2024	4.16.5	Medium
`*-4.15.7`	MStore API <= 4.15.7 - Authenticated (Subscriber+) SQL Injection	November 19, 2024	4.15.8	Medium
`*-4.15.3`	MStore API – Create Native Android & iOS Apps On The Cloud <= 4.15.3 - Authenticated (Subscriber+) Limited Arbitrary File Upload	September 12, 2024	4.15.4	Medium
`*-4.15.3`	MStore API – Create Native Android & iOS Apps On The Cloud <= 4.15.3 - Unauthorized User Registration	September 12, 2024	4.15.4	High
`*-4.15.2`	MStore API – Create Native Android & iOS Apps On The Cloud <= 4.15.2 - Authentication Bypass to Account Takeover	August 14, 2024	4.15.3	High
`*-4.14.7`	MStore API – Create Native Android & iOS Apps On The Cloud <= 4.14.7 - Authentication Bypass	July 11, 2024	4.15.0	Critical
`*-4.10.1`	MStore API <= 4.10.1 - Cross-Site Request Forgery	December 26, 2023	4.10.2	Medium
`*-4.0.6`	MStore API <= 4.0.6 - Authenticated (Subscriber+) SQL Injection	October 3, 2023	4.0.7	High
`*-4.0.1`	MStore API <= 4.0.1 - Unauthenticated SQL Injection	June 23, 2023	4.0.2	Critical
`*-3.9.7`	MStore API <= 3.9.7 - Unauthenticated SQL Injection	June 19, 2023	3.9.8	Critical
`*-3.9.8`	MStore API <= 3.9.8 - Unauthenticated Privilege Escalation	June 19, 2023	3.9.9	Critical
`*-3.9.7`	MStore API <= 3.9.7 - Unauthenticated SQL Injection	June 19, 2023	3.9.8	Critical
`*-4.10.7`	MStore API <= 4.10.7 - Unauthorized Account Access and Privilege Escalation	June 19, 2023	4.10.8	Critical
`*-3.9.6`	MStore API <= 3.9.6 - Cross-Site Request Forgery to Firebase Server Key Update	June 13, 2023	3.9.7	Medium
`*-3.9.6`	MStore API <= 3.9.6 - Cross-Site Request Forgery to Order Title Update	June 13, 2023	3.9.7	Medium
`*-3.9.6`	MStore API <= 3.9.6 - Cross-Site Request Forgery to Order Status Update	June 13, 2023	3.9.7	Medium
`*-3.9.6`	MStore API <= 3.9.6 - Cross-Site Request Forgery to Order Title Update	June 13, 2023	3.9.7	Medium
`*-3.9.6`	MStore API <= 3.9.6 - Cross-Site Request Forgery to Order Message Update	June 13, 2023	3.9.7	Medium
`*-3.9.6`	MStore API <= 3.9.6 - Cross-Site Request Forgery to Product Limit Update	June 13, 2023	3.9.7	Medium
`[*, 3.9.7)`	MStore API <= 3.9.6 - Missing Authorization	June 12, 2023	3.9.7	Medium

Selected source records

Latest Records

MediumCVE-2026-57375

MStore API – Create Native Android & iOS Apps On The Cloud <= 4.18.4 - Missing Authorization

Published: July 7, 2026

Affected versions: *-4.18.4
Patched versions: 4.19.0

Original Wordfence record

MediumCVE-2026-54817

MStore API – Create Native Android & iOS Apps On The Cloud <= 4.18.4 - Missing Authorization

Published: June 17, 2026

Affected versions: *-4.18.4
Patched versions: 4.19.0

Original Wordfence record

MediumCVE-2026-3568

MStore API <= 4.18.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Meta Update

Published: April 8, 2026

Affected versions: *-4.18.3
Patched versions: 4.18.4

Original Wordfence record

MediumCVE-2025-4683

MStore API – Create Native Android & iOS Apps On The Cloud <= 4.17.5 - Missing Authorization to Authenticated (Subscriber+) Posts Creation

Published: May 26, 2025

Affected versions: *-4.17.5
Patched versions: 4.17.6

Original Wordfence record

MediumCVE-2025-3438

MStore API – Create Native Android & iOS Apps On The Cloud <= 4.17.4 - Unauthenticated Limited Privilege Escalation

Published: May 1, 2025

Affected versions: *-4.17.4
Patched versions: 4.17.5

Original Wordfence record

MediumCVE-2024-12042

MStore API – Create Native Android & iOS Apps On The Cloud <= 4.16.4 - Authenticated (Subscriber+) HTML File Upload (Stored Cross-Site Scripting)

Published: December 12, 2024

Affected versions: *-4.16.4
Patched versions: 4.16.5

Original Wordfence record

MediumCVE-2024-11179

MStore API <= 4.15.7 - Authenticated (Subscriber+) SQL Injection

Published: November 19, 2024

Affected versions: *-4.15.7
Patched versions: 4.15.8

Original Wordfence record

MediumCVE-2024-8242

MStore API – Create Native Android & iOS Apps On The Cloud <= 4.15.3 - Authenticated (Subscriber+) Limited Arbitrary File Upload

Published: September 12, 2024

Affected versions: *-4.15.3
Patched versions: 4.15.4

Original Wordfence record

Highest-Severity Records

Critical

MStore API < 3.4.5 - Arbitrary File Upload

Published: October 5, 2021

Affected versions: [*, 3.4.5)
Patched versions: 3.4.5

Original Wordfence record

CriticalCVE-2021-24148

MStore API <= 3.1.9 - Authentication Bypass

Published: February 2, 2021

Affected versions: *-3.1.9
Patched versions: 3.2.0

Original Wordfence record

CriticalCVE-2024-6328

MStore API – Create Native Android & iOS Apps On The Cloud <= 4.14.7 - Authentication Bypass

Published: July 11, 2024

Affected versions: *-4.14.7
Patched versions: 4.15.0

Original Wordfence record

CriticalCVE-2023-3277

MStore API <= 4.10.7 - Unauthorized Account Access and Privilege Escalation

Published: June 19, 2023

Affected versions: *-4.10.7
Patched versions: 4.10.8

Original Wordfence record

CriticalCVE-2023-3197

MStore API <= 4.0.1 - Unauthenticated SQL Injection

Published: June 23, 2023

Affected versions: *-4.0.1
Patched versions: 4.0.2

Original Wordfence record

CriticalCVE-2022-47614

MStore API <= 3.9.7 - Unauthenticated SQL Injection

Published: June 19, 2023

Affected versions: *-3.9.7
Patched versions: 3.9.8

Original Wordfence record

CriticalCVE-2023-2734

MStore API <= 3.9.1 - Authentication Bypass

Published: May 22, 2023

Affected versions: *-3.9.1
Patched versions: 3.9.2

Original Wordfence record

CriticalCVE-2023-3076

MStore API <= 3.9.8 - Unauthenticated Privilege Escalation

Published: June 19, 2023

Affected versions: *-3.9.8
Patched versions: 3.9.9

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory