WordPress WPMobile.App (wpappninja) contains an improper neutralization of input during web page generation that allows an attacker to inject malicious scripts into the page output. This improper handling corresponds to a classic XSS weakness (CWE‑79) and could enable arbitrary script execution in a victim’s browser when the affected plugin processes influenced input. The impact is confined to the browser context of visitors to the site; an attacker could use the injected script to alter the displayed content or perform client‑side actions.

The vulnerability affects all WordPress sites running the WPMobile.App plugin version 11.71 or earlier. The vendor is Amauri, and the issue is present in every release from the first documented version through 11.71.

The CVSS score of 7.1 indicates a high severity level. The EPSS value of < 1 % suggests that exploitation is currently uncommon but possible. The vulnerability is not listed in CISA’s KEV catalog. Because the flaw is remote‑based and depends on an attacker supplying crafted input to the plugin’s endpoints, it can be triggered from an external host with knowledge of the plugin’s interface.