Mstore Api
Vendor:
First CVE: Mar 18, 2021 · Active for 5 years
28
Total CVEs
More Total CVEs than 96% of tracked products
7.0
Avg CVEs / Year
Higher CVE frequency than 92% of tracked products
7.3
Avg CVSS
Higher Avg CVSS than 48% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Mstore Api over time
Volume of CVEsAvg CVSS Base Score
First CVE
Mar 18, 2021
5 years ago
Most Recent CVE
May 27, 2025
424 days ago
CVE Severity & Scoring
Mstore Api28 CVEs
39%
18%
39%
All CVEs352,708 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local0 (0.0%)
Network28 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low27 (96.4%)
High1 (3.6%)
Unknown0 (0.0%)
User Interaction
None19 (67.9%)
Unknown0 (0.0%)
Required9 (32.1%)
Privileges Required
Low6 (21.4%)
High0 (0.0%)
None22 (78.6%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (28 CVEs).
28 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-2732CRITICAL The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.2. This is due to insufficient verification on the user being suppl | May 25, 2023 | 9.8 | 77 | NO | YES |
CVE-2023-3277CRITICAL The MStore API plugin for WordPress is vulnerable to Unauthorized Account Access and Privilege Escalation in versions up to, and including, 4.10.7 due to improper implementation of | Nov 3, 2023 | 9.8 | 44 | NO | YES |
CVE-2023-3077CRITICAL The MStore API WordPress plugin before 3.9.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to a Blind SQL injection exploitable by unauthenti | Jul 10, 2023 | 9.8 | 41 | NO | YES |
CVE-2023-2734CRITICAL The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.1. This is due to insufficient verification on the user being suppl | May 25, 2023 | 9.8 | 41 | NO | YES |
CVE-2023-3197CRITICAL The MStore API plugin for WordPress is vulnerable to Unauthenticated Blind SQL Injection via the 'id' parameter in versions up to, and including, 4.0.1 due to insufficient escaping | Jun 24, 2023 | 9.8 | 40 | NO | YES |
CVE-2023-3076CRITICAL The MStore API WordPress plugin before 3.9.9 does not prevent visitors from creating user accounts with the role of their choice via their wholesale REST API endpoint. This is only | Jul 10, 2023 | 9.8 | 31 | NO | NO |
CVE-2023-2733CRITICAL The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.0. This is due to insufficient verification on the user being suppl | May 25, 2023 | 9.8 | 31 | NO | NO |
CVE-2021-24148CRITICAL A business logic issue in the MStore API WordPress plugin, versions before 3.2.0, had an authentication bypass with Sign In With Apple allowing unauthenticated users to recover an | Mar 18, 2021 | 9.8 | 29 | NO | NO |
CVE-2024-6328CRITICAL The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.14.7. This is due | Jul 12, 2024 | 9.8 | 28 | NO | NO |
CVE-2023-45055CRITICAL Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in InspireUI MStore API allows SQL Injection.This issue affects MStore API: from | Nov 6, 2023 | 9.8 | 28 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (28 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
5 CVEs
17.9% of CVEs· 98th percentile
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (28 CVEs).
Media Mentions
Signals from CVEs in this product scope (28 CVEs).
Top CNAs Publishing CVEs For Mstore Api
Top CWEs
Versions
No cataloged versions.