CVE-2026-103421 is a stored cross-site scripting vulnerability in the WPMobile.App – Android and iOS App Builder WordPress plugin. The flaw arises from insufficient sanitization and escaping of the REQUEST_URI path segment after /android_json/search/, allowing unauthenticated attackers to inject arbitrary web scripts. These scripts execute when a user accesses the injected page, but exploitation depends on the app being configured in 'webview' content mode rather than the 'speed' option set to '1'. The vulnerability affects all versions up to and including 11.84.

An attacker can inject persistent malicious scripts into pages served by the plugin, which execute in the context of users visiting those pages. This can lead to information disclosure or session hijacking. However, exploitation requires the app to be configured in 'webview' mode, which is supported but not the default. The vulnerability does not allow privilege escalation or denial of service. The CVSS 3.1 base score is 5.4 (medium), reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and partial confidentiality and integrity impact.

No official patch or fix is currently documented. Users should verify if a vendor advisory is available for updates. As a temporary mitigation, configuring the app to use the 'speed' content mode option set to '1' (disabling 'webview' mode) may prevent exploitation. Monitor vendor channels for official patches or updates addressing this vulnerability.