Apcu Manager
Monthly
Stored Cross-Site Scripting in the APCu Manager WordPress plugin before 4.5.0 lets unauthenticated attackers seed a malicious APCu object-cache key (for example via a crafted transient name) that later executes arbitrary JavaScript in the browser of any administrator who opens the plugin's admin-area page. Publicly available exploit code exists (reported by WPScan) and a vendor patch is available, but there is no public exploit identified as being actively used; EPSS is low at 0.16% (5th percentile), consistent with the SSVC exploitation status of none.
Stored Cross-Site Scripting in the APCu Manager WordPress plugin before 4.5.0 lets unauthenticated attackers seed a malicious APCu object-cache key (for example via a crafted transient name) that later executes arbitrary JavaScript in the browser of any administrator who opens the plugin's admin-area page. Publicly available exploit code exists (reported by WPScan) and a vendor patch is available, but there is no public exploit identified as being actively used; EPSS is low at 0.16% (5th percentile), consistent with the SSVC exploitation status of none.