Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nebelhorn Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App yournewsapp allows Reflected XSS.This issue affects Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App: from n/a through <= 0.8.8.8.
Published: 2025-12-31
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Blappsta Mobile App Plugin contains an improper neutralization of input during web page generation, allowing attackers to inject malicious scripts via crafted URLs. This reflected cross‑site scripting flaw can execute arbitrary client‑side code in the context of the victim's browser, enabling theft of credentials, session hijacking, or defacement of the site. The weakness is categorized as CWE‑79.

Affected Systems

The vulnerability affects nebelhorn's Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App for all releases up to and including version 0.8.8.8. Users running any earlier version are at risk.

Risk and Exploitability

The CVSS score of 7.1 indicates a high‑severity issue, while an EPSS score of less than 1% suggests a low probability of active exploitation. The vulnerability is not listed in CISA’s KEV catalog. Likely exploitation would involve a remote attacker crafting a malicious URL that a user clicks, causing the injected script to run in the user's browser.

Generated by OpenCVE AI on April 30, 2026 at 04:26 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Blappsta Mobile App Plugin to a version newer than 0.8.8.8.
  • If an immediate upgrade is not possible, disable any features that accept unsanitized user input or configure the plugin to reject suspect requests.
  • Deploy a web application firewall or security plugin that blocks reflected XSS payloads and sanitizes incoming parameters.

Generated by OpenCVE AI on April 30, 2026 at 04:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 28 Apr 2026 18:30:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nebelhorn Blappsta Mobile App Plugin &#8211; Your native, mobile iPhone App and Android App yournewsapp allows Reflected XSS.This issue affects Blappsta Mobile App Plugin &#8211; Your native, mobile iPhone App and Android App: from n/a through <= 0.8.8.8. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nebelhorn Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App yournewsapp allows Reflected XSS.This issue affects Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App: from n/a through <= 0.8.8.8.

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nebelhorn Blappsta Mobile App Plugin & Your native, mobile iPhone App and Android App allows Reflected XSS.This issue affects Blappsta Mobile App Plugin &#8211; Your native, mobile iPhone App and Android App: from n/a through 0.8.8.8. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nebelhorn Blappsta Mobile App Plugin &#8211; Your native, mobile iPhone App and Android App yournewsapp allows Reflected XSS.This issue affects Blappsta Mobile App Plugin &#8211; Your native, mobile iPhone App and Android App: from n/a through <= 0.8.8.8.
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Tue, 20 Jan 2026 15:30:00 +0000

Type Values Removed Values Added
References

Tue, 20 Jan 2026 14:45:00 +0000

Type Values Removed Values Added
References

Mon, 05 Jan 2026 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google android
Nebelhorn
Nebelhorn blappsta Mobile App Plugin
Wordpress
Wordpress wordpress
Vendors & Products Google
Google android
Nebelhorn
Nebelhorn blappsta Mobile App Plugin
Wordpress
Wordpress wordpress

Fri, 02 Jan 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 31 Dec 2025 20:15:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nebelhorn Blappsta Mobile App Plugin & Your native, mobile iPhone App and Android App allows Reflected XSS.This issue affects Blappsta Mobile App Plugin &#8211; Your native, mobile iPhone App and Android App: from n/a through 0.8.8.8.
Title WordPress Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App Plugin <= 0.8.8.8 - Cross Site Scripting (XSS) Vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

Google Android
Nebelhorn Blappsta Mobile App Plugin
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:13:17.005Z

Reserved: 2025-06-11T16:08:50.969Z

Link: CVE-2025-50053

cve-icon Vulnrichment

Updated: 2026-01-02T15:32:02.627Z

cve-icon NVD

Status : Deferred

Published: 2025-12-31T20:15:42.793

Modified: 2026-04-28T19:33:22.127

Link: CVE-2025-50053

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-30T04:30:27Z

Weaknesses