WordPress ManageWP Worker plugin < 4.9.37 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by Jakub Herman in WordPress Plugin ManageWP Worker versions 4.9.37...

CVE-2026-18052

The ManageWP Worker WordPress plugin before 4.9.37 does not bind the account being logged in to the signature which authorises the login, nor prevent an already used login link from being replayed, allowing attackers who obtain such a link to gain a session as any user on the site, including an...

EUVD-2026-64219

The ManageWP Worker WordPress plugin before 4.9.37 does not bind the account being logged in to the signature which authorises the login, nor prevent an already used login link from being replayed, allowing attackers who obtain such a link to gain a session as any user on the site, including an...

CVE-2026-18052 ManageWP Worker < 4.9.37 - Unauthenticated Authentication Bypass via Unsigned Auto-Login Parameters

The ManageWP Worker WordPress plugin before 4.9.37 does not bind the account being logged in to the signature which authorises the login, nor prevent an already used login link from being replayed, allowing attackers who obtain such a link to gain a session as any user on the site, including an...

CVE-2026-18052 ManageWP Worker < 4.9.37 - Unauthenticated Authentication Bypass via Unsigned Auto-Login Parameters

The ManageWP Worker WordPress plugin before 4.9.37 does not bind the account being logged in to the signature which authorises the login, nor prevent an already used login link from being replayed, allowing attackers who obtain such a link to gain a session as any user on the site, including an...

CVE-2026-18052

The ManageWP Worker WordPress plugin (versions prior to 4.9.37 ) contains an unauthenticated authentication bypass vulnerability. The root cause is that the plugin fails to bind the logged-in account to the signature authorizing the login and does not prevent the replay of previously used login l...

PT-2026-79510

Name of the Vulnerable Software and Affected Versions ManageWP Worker versions prior to 4.9.37 Description An authentication bypass exists because the plugin fails to bind the account being logged in to the signature that authorizes the login. Additionally, the system does not prevent the replay ...

CVE-2026-18052: Improper Authentication

The ManageWP Worker WordPress plugin before 4.9.37 does not bind the account being logged in to the signature which authorises the login, nor prevent an already used login link from being replayed, allowing attackers who obtain such a link to gain a session as any user on the site, including an...

EUVD-2026-36931

Unauthenticated Cross Site Scripting XSS in ManageWP Worker = 4.9.31 versions...

CVE-2026-39463

Unauthenticated Cross Site Scripting XSS in ManageWP Worker = 4.9.31 versions...

CVE-2026-39463

CVE-2026-39463 affects the WordPress plugin ManageWP Worker (versions

CVE-2026-39463 WordPress ManageWP Worker plugin <= 4.9.31 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in ManageWP Worker = 4.9.31 versions...

CVE-2026-39463 WordPress ManageWP Worker plugin <= 4.9.31 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in ManageWP Worker = 4.9.31 versions...

PT-2026-49374

Unauthenticated Cross Site Scripting XSS in ManageWP Worker = 4.9.31 versions...

CVE-2026-39463: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in ManageWP Worker = 4.9.31 versions...

CVE-2026-3718

The ManageWP Worker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'MWP-Key-Name' HTTP request header in all versions up to, and including, 4.9.31. This is due to insufficient input sanitization and output escaping of attacker-controlled header values. This makes it...

WordPress ManageWP Worker plugin <= 4.9.31 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by timomangcut in WordPress Plugin ManageWP Worker versions = 4.9.31...

CVE-2026-3718

The ManageWP Worker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'MWP-Key-Name' HTTP request header in all versions up to, and including, 4.9.31. This is due to insufficient input sanitization and output escaping of attacker-controlled header values. This makes it...

EUVD-2026-30246

The ManageWP Worker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'MWP-Key-Name' HTTP request header in all versions up to, and including, 4.9.31. This is due to insufficient input sanitization and output escaping of attacker-controlled header values. This makes it...

CVE-2026-3718 ManageWP Worker <= 4.9.31 - Unauthenticated Stored Cross-Site Scripting via 'MWP-Key-Name' Header

The ManageWP Worker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'MWP-Key-Name' HTTP request header in all versions up to, and including, 4.9.31. This is due to insufficient input sanitization and output escaping of attacker-controlled header values. This makes it...