Is App Builder safe?

Every recorded flaw

• Oct 19, 2026App Builder: Does not require authentication or authorisation before writing attacker-supplied data to one of its options andCVE-2026-94294 · fixed in 5.7.1 · reported by WPScanMedium 5.3
• May 2, 2026App Builder – Create Native Android & iOS Apps On The Flight: Insecure Direct Object ReferenceCVE-2026-7638 · affects up to 5.6.0 · reported by WordfenceMedium 5.3
• Mar 21, 2026App Builder – Create Native Android & iOS Apps On The Flight: Privilege EscalationCVE-2026-2375 · affects up to 5.5.10 · reported by WordfenceMedium 6.5
• Jun 20, 2025App Builder: Missing AuthorizationCVE-2025-49989 · affects up to 5.5.6 · reported by PatchstackMedium 5.3
• Oct 25, 2024App Builder – Create Native Android & iOS Apps On The Flight: Privilege escalationCVE-2024-9302 · affects up to 5.3.7 · reported by WordfenceHigh 8.1
• Aug 21, 2024App Builder – Create Native Android & iOS Apps On The Flight: Limited SQL InjectionCVE-2024-7651 · affects up to 4.2.6 · reported by WordfenceMedium 5.6
• Apr 18, 2024App Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-32565 · affects up to 3.8.8 · reported by PatchstackMedium 6.5
• Apr 10, 2024App Builder: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-31282 · affects up to 3.8.7 · reported by PatchstackMedium 4.7

Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.