MStore API – Create Native Android & iOS Apps On The Cloud

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Modeled within the band wp.org reports; tightens as we track daily.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price. A small install base leaves thin data to model from. The recent download trend is too spiky to read.

Recent releases and news for this plugin

1. — Version 4.20.0 Add tiered_prices endpoint Add catalog visibility option in product create/update Add date on sale support in product create/update Add vendor auto-approval selling configuration Support B2BKing (login, orders, guest che 4.20.0
2. — Version 4.19.0 Add Cashfree payment integration Add get_location_fields endpoint Support listing_id in get-reviews-criteria API and return value/count stats Support multi images in get_reviews (Listeo) Support HTML content for blog cre 4.19.0
3. — Version 4.18.4 Built-in support for WP REST API (Pure Taxonomies & REST API Controller plugins no longer required) Add support for ModemPay webhook Add support for Local Delivery Drivers for WooCommerce (Premium) Improve handling for s 4.18.4
4. — Version 4.18.3 fix: validate to checkout for auction product validate coupon discount before setting price_discount field Guard comment_arr before encoding comment field Support upload review images and respect status from app add miss 4.18.3
5. — Version 4.18.2 fix: wrong store data as product return author if not has store feat: add get_fees api for woocommerce Support Razorpay api payment Fix to apply points for webview checkout Update flutter_get_orders to use Orders V2 Cont 4.18.2
6. — Version 4.18.1 Support checkout fields manager 4.18.1

35 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. Critical · 9.8 MStore API – Create Native Android & iOS Apps On The Cloud <= 4.20.0 - Unauthenticated Privilege Escalation ↗
   2026-08-11 CVE-2026-27543 Incorrect Privilege Assignment Affects <= 4.20.0 Patched in 4.21.0
2. Medium · 4.3 MStore API <= 4.20.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Order and Customer PII Disclosure ↗
   2026-08-03 CVE-2026-16039 Authorization Bypass Through User-Controlled Key Affects <= 4.20.0 Patched in 4.21.0
3. Medium · 5.3 MStore API <= 4.20.0 - Missing Authorization ↗
   2026-08-03 CVE-2026-16041 Missing Authorization Affects <= 4.20.0 Patched in 4.21.0
4. Medium · 5.3 MStore API <= 4.20.0 - Missing Authorization ↗
   2026-08-03 CVE-2026-16038 Missing Authorization Affects <= 4.20.0 Patched in 4.21.0
5. Medium · 5.3 MStore API – Create Native Android & iOS Apps On The Cloud <= 4.18.4 - Missing Authorization ↗
   2026-07-07 CVE-2026-57375 Missing Authorization Affects <= 4.18.4 Patched in 4.19.0
6. Medium · 5.3 MStore API – Create Native Android & iOS Apps On The Cloud <= 4.18.4 - Missing Authorization ↗
   2026-06-17 CVE-2026-54817 Missing Authorization Affects <= 4.18.4 Patched in 4.19.0
7. Medium · 4.3 MStore API <= 4.18.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Meta Update ↗
   2026-04-08 CVE-2026-3568 Authorization Bypass Through User-Controlled Key Affects <= 4.18.3 Patched in 4.18.4
8. Medium · 4.3 MStore API – Create Native Android & iOS Apps On The Cloud <= 4.17.5 - Missing Authorization to Authenticated (Subscriber+) Posts Creation ↗
   2025-05-26 CVE-2025-4683 Missing Authorization Affects <= 4.17.5 Patched in 4.17.6
9. Medium · 6.5 MStore API – Create Native Android & iOS Apps On The Cloud <= 4.17.4 - Unauthenticated Limited Privilege Escalation ↗
   2025-05-01 CVE-2025-3438 Improper Privilege Management Affects <= 4.17.4 Patched in 4.17.5
10. Medium · 5.4 MStore API – Create Native Android & iOS Apps On The Cloud <= 4.16.4 - Authenticated (Subscriber+) HTML File Upload (Stored Cross-Site Scripting) ↗
    2024-12-12 CVE-2024-12042 Unrestricted Upload of File with Dangerous Type Affects <= 4.16.4 Patched in 4.16.5
11. Medium · 6.5 MStore API <= 4.15.7 - Authenticated (Subscriber+) SQL Injection ↗
    2024-11-19 CVE-2024-11179 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 4.15.7 Patched in 4.15.8
12. Medium · 4.3 MStore API – Create Native Android & iOS Apps On The Cloud <= 4.15.3 - Authenticated (Subscriber+) Limited Arbitrary File Upload ↗
    2024-09-12 CVE-2024-8242 Unrestricted Upload of File with Dangerous Type Affects <= 4.15.3 Patched in 4.15.4
13. High · 7.3 MStore API – Create Native Android & iOS Apps On The Cloud <= 4.15.3 - Unauthorized User Registration ↗
    2024-09-12 CVE-2024-8269 Improper Access Control Affects <= 4.15.3 Patched in 4.15.4
14. High · 8.1 MStore API – Create Native Android & iOS Apps On The Cloud <= 4.15.2 - Authentication Bypass to Account Takeover ↗
    2024-08-14 CVE-2024-7628 Authentication Bypass Using an Alternate Path or Channel Affects <= 4.15.2 Patched in 4.15.3
15. Critical · 9.8 MStore API – Create Native Android & iOS Apps On The Cloud <= 4.14.7 - Authentication Bypass ↗
    2024-07-11 CVE-2024-6328 Authentication Bypass Using an Alternate Path or Channel Affects <= 4.14.7 Patched in 4.15.0
16. Medium · 4.3 MStore API <= 4.10.1 - Cross-Site Request Forgery ↗
    2023-12-26 CVE-2023-50878 Cross-Site Request Forgery (CSRF) Affects <= 4.10.1 Patched in 4.10.2
17. High · 8.8 MStore API <= 4.0.6 - Authenticated (Subscriber+) SQL Injection ↗
    2023-10-03 CVE-2023-45055 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 4.0.6 Patched in 4.0.7
18. Critical · 9.8 MStore API <= 4.0.1 - Unauthenticated SQL Injection ↗
    2023-06-23 CVE-2023-3197 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 4.0.1 Patched in 4.0.2
19. Critical · 9.8 MStore API <= 4.10.7 - Unauthorized Account Access and Privilege Escalation ↗
    2023-06-19 CVE-2023-3277 Authentication Bypass Using an Alternate Path or Channel Affects <= 4.10.7 Patched in 4.10.8
20. Critical · 9.8 MStore API <= 3.9.7 - Unauthenticated SQL Injection ↗
    2023-06-19 CVE-2022-47614 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 3.9.7 Patched in 3.9.8
21. Critical · 9.8 MStore API <= 3.9.8 - Unauthenticated Privilege Escalation ↗
    2023-06-19 CVE-2023-3076 Incorrect Privilege Assignment Affects <= 3.9.8 Patched in 3.9.9
22. Critical · 9.8 MStore API <= 3.9.7 - Unauthenticated SQL Injection ↗
    2023-06-19 CVE-2023-3077 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 3.9.7 Patched in 3.9.8
23. Medium · 4.3 MStore API <= 3.9.6 - Cross-Site Request Forgery to Product Limit Update ↗
    2023-06-13 CVE-2023-3203 Cross-Site Request Forgery (CSRF) Affects <= 3.9.6 Patched in 3.9.7
24. Medium · 4.3 MStore API <= 3.9.6 - Cross-Site Request Forgery to Order Message Update ↗
    2023-06-13 CVE-2023-3200 Cross-Site Request Forgery (CSRF) Affects <= 3.9.6 Patched in 3.9.7
25. Medium · 4.3 MStore API <= 3.9.6 - Cross-Site Request Forgery to Order Title Update ↗
    2023-06-13 CVE-2023-3199 Cross-Site Request Forgery (CSRF) Affects <= 3.9.6 Patched in 3.9.7
26. Medium · 4.3 MStore API <= 3.9.6 - Cross-Site Request Forgery to Order Status Update ↗
    2023-06-13 CVE-2023-3198 Cross-Site Request Forgery (CSRF) Affects <= 3.9.6 Patched in 3.9.7
27. Medium · 4.3 MStore API <= 3.9.6 - Cross-Site Request Forgery to Order Title Update ↗
    2023-06-13 CVE-2023-3201 Cross-Site Request Forgery (CSRF) Affects <= 3.9.6 Patched in 3.9.7
28. Medium · 4.3 MStore API <= 3.9.6 - Cross-Site Request Forgery to Firebase Server Key Update ↗
    2023-06-13 CVE-2023-3202 Cross-Site Request Forgery (CSRF) Affects <= 3.9.6 Patched in 3.9.7
29. Medium · 6.5 MStore API <= 3.9.6 - Missing Authorization ↗
    2023-06-12 CVE-2023-3131 Missing Authorization Affects < 3.9.7 Patched in 3.9.7
30. Critical · 9.8 MStore API <= 3.9.2 - Authentication Bypass ↗
    2023-05-24 CVE-2023-2732 Authentication Bypass Using an Alternate Path or Channel Affects <= 3.9.2 Patched in 3.9.3
31. Critical · 9.8 MStore API <= 3.9.1 - Authentication Bypass ↗
    2023-05-22 CVE-2023-2734 Authentication Bypass Using an Alternate Path or Channel Affects <= 3.9.1 Patched in 3.9.2
32. Critical · 9.8 MStore API <= 3.9.0 - Authentication Bypass ↗
    2023-05-17 CVE-2023-2733 Authentication Bypass Using an Alternate Path or Channel Affects <= 3.9.0 Patched in 3.9.1
33. Critical · 9.8 MStore API < 3.4.5 - Arbitrary File Upload ↗
    2021-10-05 Unrestricted Upload of File with Dangerous Type Affects < 3.4.5 Patched in 3.4.5
34. Critical · 9.8 MStore API <= 3.1.9 - Authentication Bypass ↗
    2021-02-02 CVE-2021-24148 Authentication Bypass Using an Alternate Path or Channel Affects <= 3.1.9 Patched in 3.2.0
35. Critical · 9.8 MStore API <= 2.1.5 - Authentication Bypass ↗
    2020-03-11 CVE-2020-36713 Authentication Bypass Using an Alternate Path or Channel Affects < 2.1.6 Patched in 2.1.6

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-08-29 2K+ → 3K+ up after 3 days in tier
2. 2026-08-26 3K+ → 2K+ down after 271 days in tier
3. 2025-11-28 4K+ → 3K+ down after 1 days in tier
4. 2025-11-27 3K+ → 4K+ up after 2 days in tier
5. 2025-11-25 4K+ → 3K+ down after 1 days in tier
6. 2025-11-24 3K+ → 4K+ up after 1 days in tier
7. 2025-11-23 4K+ → 3K+ down after 3 days in tier
8. 2025-11-20 3K+ → 4K+ up after 6 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• App Builder – Create Native Android & iOS Apps On The Flight 600+ installs · 3.9★ · 3 shared tags B
• Appza builder 10+ installs · 3.6★ · 3 shared tags B
• WappPress – Convert Site to App Fast – WordPress to Mobile App Builder 1K+ installs · 3.7★ · 2 shared tags B
• Mobile App Editor – WordPress to Android App Builder 40+ installs · 4.1★ · 2 shared tags D
• Taqnix 30+ installs · 3.6★ · 2 shared tags B
• TC Ecommerce – Create Android & iOS Apps for WooCommerce 30+ installs · 3.6★ · 2 shared tags C

Embed this report card

Drop a live Pulse card for MStore API – Create Native Android & iOS Apps On The Cloud into a readme, a review or a deck. It updates itself.

MStore API – Create Native Android & iOS Apps On The Cloud: 3K+ active installs, 3.7★ (21 reviews). Plugin Pulse (WP Mayor), as of 2026-08-29. https://plugins.wpmayor.com/plugin/mstore-api