CVE-2026-3718

Περιγραφή

The ManageWP Worker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the -MWP-Key-Name- HTTP request header in all versions up to, and including, 4.9.31. This is due to insufficient input sanitization and output escaping of attacker-controlled header values. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator visits the plugin-s connection management page with debug parameters.