inspireui

Records30All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical12CVSS 9.0–10.0

CVSS high6CVSS 7.0–8.9

Exploited now

inspireui records in CISA KEV

No inspireui vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Mstore Api 28 records CRITICAL

Records

28 records in Mstore Api · all components

TI-2023-02559 CVE-2023-2732 · GHSA-q639-qhhx-5j5j

MStore API <= 3.9.2 - Authentication Bypass

CRITICAL 85

The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.2.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.67284 Published 2023-05-25 No fix listed CWE-288

TI-2023-02883 CVE-2023-3077 · GHSA-95vf-7jgr-4c75

MStore API < 3.9.8 - Unauthenticated Blind SQLi

HIGH 82

The MStore API WordPress plugin before 3.9.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to a Blind SQL injection exploitable by unauthenticated users.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.05505 Published 2023-07-10 Fixed in 3.9.8

TI-2023-02882 CVE-2023-3076 · GHSA-gwr5-qqvh-c57m

MStore API < 3.9.9 - Unauthenticated Privilege Escalation

HIGH 82

The MStore API WordPress plugin before 3.9.9 does not prevent visitors from creating user accounts with the role of their choice via their wholesale REST API endpoint.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02168 Published 2023-07-10 Fixed in 3.9.9 CWE-862

TI-2023-03070 CVE-2023-3277 · GHSA-7pc7-crj3-6p7v

MStore API <= 4.10.7 - Unauthorized Account Access and Privilege Escalation

MEDIUM 55

The MStore API plugin for WordPress is vulnerable to Unauthorized Account Access and Privilege Escalation in versions up to, and including, 4.10.7 due to improper implementation of the Apple login feature.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03421 Published 2023-11-03 No fix listed CWE-288

TI-2023-02994 CVE-2023-3197 · GHSA-3xv2-fg82-8w4g

MStore API <= 4.0.1 - Unauthenticated SQL Injection

MEDIUM 55

The MStore API plugin for WordPress is vulnerable to Unauthenticated Blind SQL Injection via the 'id' parameter in versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameters and lac…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0387 Published 2023-06-24 No fix listed CWE-89

TI-2023-02561 CVE-2023-2734 · GHSA-29f6-99cv-fjv5

MStore API <= 3.9.1 - Authentication Bypass

MEDIUM 55

The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03805 Published 2023-05-25 No fix listed CWE-288

TI-2023-02934 CVE-2023-3131 · GHSA-7x52-4x54-c7jw

MStore API < 3.9.7 - Subscriber+ Unauthorized Settings Update

MEDIUM 53

The MStore API WordPress plugin before 3.9.7 does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a combination of both.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00627 Published 2023-07-10 Fixed in 3.9.7

TI-2020-18884 CVE-2020-36713 · GHSA-4w36-8q8w-r4jp

MStore API <= 2.1.5 - Authentication Bypass

MEDIUM 52

The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.1.5.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01605 Published 2023-06-07 Fixed in 2.1.6 CWE-288

TI-2023-02560 CVE-2023-2733 · GHSA-2493-c7mq-cpj4

MStore API <= 3.9.0 - Authentication Bypass

MEDIUM 51

The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01246 Published 2023-05-25 No fix listed CWE-288

TI-2024-05872 CVE-2024-6328 · GHSA-xgv9-3cm6-qccq

MStore API – Create Native Android & iOS Apps On The Cloud <= 4.14.7 - Authentication Bypass

MEDIUM 50

The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.14.7.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0067 Published 2024-07-12 No fix listed CWE-288

TI-2023-24103 CVE-2023-45055 · GHSA-772v-9mr6-2jg6

WordPress MStore API Plugin <= 4.0.6 is vulnerable to SQL Injection

MEDIUM 50

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in InspireUI MStore API allows SQL Injection.This issue affects MStore API: from n/a through 4.0.6.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00685 Published 2023-11-06 No fix listed CWE-89

TI-2023-03005 CVE-2023-3209 · GHSA-6gwc-q32q-63j2

MStore API < 3.9.7 - Settings Update via CSRF

MEDIUM 50

The MStore API WordPress plugin before 3.9.7 does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a combination of both.

CVSS 3.1LOW 3.5 Network Low privileges User interaction EPSS 0.00275 Published 2023-07-10 Fixed in 3.9.7

TI-2021-06440 CVE-2021-24148 · GHSA-99jg-2fvv-2jfq

MStore API < 3.2.0 - Authentication Bypass With Sign In With Apple

MEDIUM 48

A business logic issue in the MStore API WordPress plugin, versions before 3.2.0, had an authentication bypass with Sign In With Apple allowing unauthenticated users to recover an authentication cookie with only an email…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03373 Published 2021-03-18 Fixed in 3.2.0 CWE-287

TI-2024-07640 CVE-2024-8242 · GHSA-cj63-c83g-7mc2

Unrestricted file upload in inspireui MStore API – Create Native Android & iOS Apps On…

LOW 39

The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the update_user_profile() function in all versions up to,…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00785 Published 2024-09-13 No fix listed CWE-434

TI-2025-03021 CVE-2025-3438 · GHSA-f367-gfrg-qv3c

MStore API – Create Native Android & iOS Apps On The Cloud <= 4.17.4 - Unauthenticated Limited Privilege Escalation

LOW 38

The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and including, 4.17.4.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00341 Published 2025-05-02 No fix listed CWE-269

TI-2024-07665 CVE-2024-8269 · GHSA-g7fv-v867-rmwj

MStore API – Create Native Android & iOS Apps On The Cloud <= 4.15.3 - Unauthorized User Registration

LOW 38

The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to unauthorized user registration in all versions up to, and including, 4.15.3.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00382 Published 2024-09-13 No fix listed CWE-284

TI-2024-07070 CVE-2024-7628 · GHSA-m362-99m5-p5fq

MStore API – Create Native Android & iOS Apps On The Cloud <= 4.15.2 - Authentication Bypass to Account Takeover

LOW 38

The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 4.15.2.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00658 Published 2024-08-15 No fix listed CWE-288

TI-2023-27782 CVE-2023-50878 · GHSA-g3jx-j73g-rrcf

WordPress MStore API Plugin <= 4.10.1 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 37

Cross-Site Request Forgery (CSRF) vulnerability in InspireUI MStore API.This issue affects MStore API: from n/a through 4.10.1.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00221 Published 2023-12-29 No fix listed CWE-352

TI-2022-23652 CVE-2022-47614 · GHSA-8832-pxqr-ww83

WordPress MStore API Plugin <= 3.9.7 is vulnerable to SQL Injection

LOW 34

Unauth. SQL Injection (SQLi) vulnerability in InspireUI MStore API plugin <= 3.9.7 versions.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00571 Published 2023-06-23 No fix listed CWE-89

TI-2024-10354 CVE-2024-11179 · GHSA-2p5q-6jvg-jx9f

MStore API <= 4.15.7 - Authenticated (Subscriber+) SQL Injection

LOW 29

The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to SQL Injection via the 'status_type' parameter in all versions up to, and including, 4.15.7 due to insufficient escaping…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00456 Published 2024-11-20 No fix listed CWE-89

TI-2024-11173 CVE-2024-12042 · GHSA-gjq7-3xfx-fg78

Unrestricted file upload in inspireui MStore API – Create Native Android & iOS Apps On…

LOW 24

The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the profile picture upload functionality in all versions up to, and including, 4.16.4 d…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00332 Published 2024-12-13 No fix listed CWE-434

TI-2025-04181 CVE-2025-4683 · GHSA-w349-f9mw-226w

Missing authorization in inspireui MStore API – Create Native Android & iOS Apps On The…

LOW 20

The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the create_blog function in all versions up to,…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00307 Published 2025-05-27 No fix listed CWE-862

TI-2023-03000 CVE-2023-3203 · GHSA-fw4w-m4pp-mgp9

MStore API <= 3.9.6 - Cross-Site Request Forgery to Product Limit Update

LOW 20

The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_limit_product function.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00314 Published 2023-06-14 No fix listed CWE-352

TI-2023-02999 CVE-2023-3202 · GHSA-w69v-wc99-wc9q

MStore API <= 3.9.6 - Cross-Site Request Forgery to Firebase Server Key Update

LOW 20

The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_firebase_server_key function.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00296 Published 2023-07-12 No fix listed CWE-352

TI-2023-02998 CVE-2023-3201 · GHSA-fg8x-c2rv-v75q

MStore API <= 3.9.6 - Cross-Site Request Forgery to Order Title Update

LOW 20

The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore_update_new_order_title function.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00314 Published 2023-06-14 No fix listed CWE-352

Open these records in search →

Critical	12
High	6
Medium	11
Low	1
No CVSS	0