CVE-2026-3718

The ManageWP Worker plugin for WordPress is affected by CVE-2026-3718: Stored Cross-Site Scripting via the MWP-Key-Name HTTP header in all versions up to 4.9.31. Root cause: insufficient input sanitization and output escaping of attacker-controlled header values. Impact: unauthenticated attackers...