What is the CVSS score of CVE-2026-10083?

CVE-2026-10083 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for CVE-2026-10083?

Yes, a public proof-of-concept exploit is available for CVE-2026-10083. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-10083?

Yes, a patch is available for CVE-2026-10083. Update the affected software to the latest version immediately.

Apcu Manager CVE-2026-10083

EUVD-2026-40039 HIGH

2026-06-29 WPScan

GHSA-p975-px59-fhr4

WordPress XSS Apcu Manager

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (WPScan) · only source for this CVE.

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 29, 2026 - 08:01 EUVD

CVE Published

Jun 29, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The APCu Manager WordPress plugin before 4.5.0 does not escape APCu object-cache keys before rendering them in an admin-area page, leading to a Stored Cross-Site Scripting vulnerability. When a persistent object cache is enabled, cache keys derived from unsanitised user input (e.g. a transient name created by another APCu Manager WordPress plugin before 4.5.0 from an unauthenticated request) are output without escaping and execute arbitrary JavaScript in the session of an administrator viewing the page.