CVE-2026-3718: XSS in ManageWP Worker WordPress Plugin
Platform
wordpress
Component
worker
Fixed in
4.9.32
CVE-2026-3718 describes a stored Cross-Site Scripting (XSS) vulnerability discovered in the ManageWP Worker plugin for WordPress. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts, potentially leading to account compromise and data theft. The vulnerability affects versions 0.0.0 through 4.9.31 of the plugin, but has been resolved in version 4.9.32.
Detect this CVE in your project
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Impact and Attack Scenarios
Successful exploitation of CVE-2026-3718 allows an attacker to inject and execute malicious JavaScript code within the context of an administrator's session. This can lead to a variety of attacks, including session hijacking, credential theft (e.g., stealing WordPress administrator passwords), and defacement of the WordPress site. The attacker could also redirect administrators to phishing sites or install malware. Because the vulnerability is stored, the injected script executes every time an administrator visits the plugin's connection management page with debug parameters, amplifying the potential impact. The lack of authentication requirements makes this vulnerability particularly concerning, as it can be exploited by anyone with access to send HTTP requests.
Exploitation Context
CVE-2026-3718 was published on May 14, 2026. As of this date, there are no publicly known active campaigns exploiting this vulnerability. No entries on KEV or EPSS are available. The CVSS score of 7.2 (HIGH) indicates a significant risk, and the ease of exploitation (unauthenticated) suggests potential for widespread exploitation if a public proof-of-concept is released. Refer to the official ManageWP advisory for further details.
Threat Intelligence
Exploit Status
CISA SSVC
CVSS Vector
What do these metrics mean?
- Attack Vector
- Network — remotely exploitable over the internet. No physical or local access required. Widest attack surface.
- Attack Complexity
- Low — no special conditions required. Attacker can exploit reliably without depending on rare configurations or timing.
- Privileges Required
- None — unauthenticated. No login or credentials needed to exploit.
- User Interaction
- None — attack is automatic and silent. Victim does nothing: no click, no file open.
- Scope
- Changed — successful attack can pivot beyond the vulnerable component to other systems or the host OS.
- Confidentiality
- Low — partial or indirect data access. Attacker gains limited information.
- Integrity
- Low — attacker can modify some data with limited scope or impact.
- Availability
- None — no availability impact. Service remains fully operational.
Affected Software
Weakness Classification (CWE)
Timeline
- Reserved
- Published
Mitigation and Workarounds
The primary mitigation for CVE-2026-3718 is to upgrade the ManageWP Worker plugin to version 4.9.32 or later. If an immediate upgrade is not possible due to compatibility issues or breaking changes, consider implementing a temporary workaround by filtering or sanitizing the 'MWP-Key-Name' HTTP request header on the web server. This can be achieved using web application firewall (WAF) rules or proxy configurations to block or modify suspicious header values. Additionally, disable debug parameters on the plugin's connection management page to reduce the attack surface. After upgrading, confirm the fix by attempting to inject a simple JavaScript payload via the 'MWP-Key-Name' header and verifying that it is not executed.
How to fix
Update to version 4.9.32, or a newer patched version
Frequently asked questions
What is CVE-2026-3718 — XSS in ManageWP Worker WordPress Plugin?
CVE-2026-3718 is a stored Cross-Site Scripting (XSS) vulnerability affecting the ManageWP Worker WordPress plugin. It allows attackers to inject malicious scripts via the 'MWP-Key-Name' HTTP header, potentially compromising administrator accounts.
Am I affected by CVE-2026-3718 in ManageWP Worker WordPress Plugin?
You are affected if you are using ManageWP Worker plugin versions 0.0.0 through 4.9.31. Upgrade to version 4.9.32 or later to mitigate the risk.
How do I fix CVE-2026-3718 in ManageWP Worker WordPress Plugin?
Upgrade the ManageWP Worker plugin to version 4.9.32 or later. As a temporary workaround, filter or sanitize the 'MWP-Key-Name' HTTP header on your web server.
Is CVE-2026-3718 being actively exploited?
As of May 14, 2026, there are no publicly known active campaigns exploiting CVE-2026-3718, but the HIGH severity score warrants immediate attention.
Where can I find the official ManageWP advisory for CVE-2026-3718?
Refer to the official ManageWP advisory for the most up-to-date information and guidance regarding CVE-2026-3718. Check the ManageWP website or their security blog for announcements.
Is your project affected?
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Detect this CVE in your project
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Scan your WordPress project now — no account
Upload any manifest (composer.lock, package-lock.json, WordPress plugin list…) or paste your component list. You get a vulnerability report instantly. Uploading a file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
Drag & drop your dependency file
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...