CVE-2026-10083

Name of the Vulnerable Software and Affected Versions APCu Manager WordPress plugin versions prior to 4.5.0

Description Stored Cross-Site Scripting occurs because the plugin fails to escape APCu object-cache keys before rendering them on an admin-area page. When a persistent object cache is active, cache keys derived from unsanitized user input—such as a transient name created via an unauthenticated request—are output without proper escaping. This allows the execution of arbitrary JavaScript within the session of an administrator who views the affected page.

Recommendations Update APCu Manager WordPress plugin to version 4.5.0 or later.