This vulnerability allows an attacker to store malicious script code in the ‘title’ field of the AppPresser – Mobile App Framework plugin. Because the value is not sanitized or escaped, the injected script is rendered when a page is accessed, causing cross‑site scripting in the victim’s browser. The vulnerability is a classic CWE‑79 flaw and permits unauthenticated users to create or modify content that will run as the logged‑in user whenever a logged‑in admin or member views the page, compromising confidentiality, integrity, and availability of the web application for those users.

AppPresser – Mobile App Framework for WordPress – versions 4.4.10 and earlier are affected. The plugin is a WordPress extension and has been identified as vulnerable by the CNA scottopolis for all releases up to 4.4.10.

The CVSS score is 7.2, indicating a high severity vulnerability. The EPSS score is below 1 %, meaning the likelihood of exploitation is currently low. The issue is not listed in CISA’s KEV catalog. Per the CVE description, the attack vector requires unauthenticated access to store a malicious title value in the plugin’s logging configuration, after which any authenticated user who views the affected page will execute the injected script. The vulnerability is therefore exploitable in realistic scenarios where logging is enabled and logged pages are viewed by users.