CVE-2026-13770 describes a stored cross-site scripting vulnerability in the AppMySite – WordPress & WooCommerce Mobile App Builder plugin for WordPress. The flaw exists in the save_ams_license_key AJAX handler, which fails to sanitize inputs and escape outputs properly. Additionally, it lacks capability checks and nonce verification, allowing any authenticated user with Subscriber-level privileges or above to inject arbitrary web scripts. These scripts persist and execute in the context of users visiting the injected pages, potentially leading to session hijacking or other script-based attacks.

An authenticated user with Subscriber-level access or higher can exploit this vulnerability to inject malicious scripts that execute in other users' browsers when they view the affected pages. This can lead to information disclosure or session hijacking. The vulnerability does not affect availability and requires user interaction (visiting the injected page) to trigger the script execution.

No official patch or fix is currently documented. Users should monitor the vendor advisory for updates. Until a fix is available, restrict user roles to trusted individuals and consider disabling or restricting access to the save_ams_license_key AJAX handler if possible. Applying strict input validation and output escaping on the affected handler is recommended once a patch is released.