EUVD-2026-40039
GHSA-p975-px59-fhr4
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Unauthenticated injection (PR:N) but gated on APCu-cache config and admin viewing (AC:H, UI:R); stored XSS crosses into the admin browser context (S:C) with limited C/I and no availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The APCu Manager WordPress plugin before 4.5.0 does not escape APCu object-cache keys before rendering them in an admin-area page, leading to a Stored Cross-Site Scripting vulnerability. When a persistent object cache is enabled, cache keys derived from unsanitised user input (e.g. a transient name created by another APCu Manager WordPress plugin before 4.5.0 from an unauthenticated request) are output without escaping and execute arbitrary JavaScript in the session of an administrator viewing the page.
Articles & Coverage 1
AnalysisAI
Stored Cross-Site Scripting in the APCu Manager WordPress plugin before 4.5.0 lets unauthenticated attackers seed a malicious APCu object-cache key (for example via a crafted transient name) that later executes arbitrary JavaScript in the browser of any administrator who opens the plugin's admin-area page. Publicly available exploit code exists (reported by WPScan) and a vendor patch is available, but there is no public exploit identified as being actively used; EPSS is low at 0.16% (5th percentile), consistent with the SSVC exploitation status of none.
Technical ContextAI
APCu Manager is a WordPress plugin that surfaces and manages the APCu (APC User Cache) in-memory object cache from the WordPress admin dashboard. When WordPress is configured to use a persistent object cache backed by APCu, transients and other cached values are stored as APCu keys. The root cause is an output-encoding failure (CWE-79, Improper Neutralization of Input During Web Page Generation) - the plugin reads cache keys and renders them into an admin HTML page without HTML-escaping. Because a key can be derived from unsanitised, attacker-controlled input (a transient name created from an unauthenticated request), the untrusted string reaches the DOM verbatim and is parsed as markup/script. The CWE is listed as N/A in the source feed, but the described behaviour is unambiguously stored/persistent XSS. Affected CPE is cpe:2.3:a:unknown:apcu_manager:*:*:*:*:*:*:*:* (vendor recorded as 'unknown').
RemediationAI
Vendor-released patch: upgrade the APCu Manager plugin to version 4.5.0 or later, which escapes cache keys before rendering them in the admin page - this is the primary and complete fix. If immediate upgrade is not possible, apply compensating controls: disable the APCu persistent object cache (remove the APCu drop-in / object-cache.php or switch the object-cache backend), which removes the attacker-controlled key path at the cost of losing APCu caching performance; or deactivate the APCu Manager plugin entirely until it can be updated, losing its cache-management UI but eliminating the vulnerable rendering path. Where neither is acceptable, restrict access to the plugin's admin pages and consider a WAF/CSP rule blocking inline script execution in wp-admin, accepting that CSP tuning can break legitimate admin scripts. See the WPScan advisory (https://wpscan.com/vulnerability/e591b3f3-6e21-44f7-b374-4753689532fe/) for confirmation of the fixed version.
Share
External POC / Exploit Code
Leaving vuln.today