CVE-2026-18052

The ManageWP Worker WordPress plugin before 4.9.37 does not bind the account being logged in to the signature which authorises the login, nor prevent an already used login link from being replayed, allowing attackers who obtain such a link to gain a session as any user on the site, including an...

CVE-2026-18052 ManageWP Worker < 4.9.37 - Unauthenticated Authentication Bypass via Unsigned Auto-Login Parameters

The ManageWP Worker WordPress plugin before 4.9.37 does not bind the account being logged in to the signature which authorises the login, nor prevent an already used login link from being replayed, allowing attackers who obtain such a link to gain a session as any user on the site, including an...

EUVD-2026-64219

The ManageWP Worker WordPress plugin before 4.9.37 does not bind the account being logged in to the signature which authorises the login, nor prevent an already used login link from being replayed, allowing attackers who obtain such a link to gain a session as any user on the site, including an...

CVE-2026-18052

CVE-2026-18052 affects the ManageWP Worker WordPress plugin in versions prior to 4.9.37 . The plugin's auto-login mechanism fails to bind the target account to the cryptographic signature that authorises the login, and does not prevent replay of an already-used login link. An attacker who obtains...

PT-2026-79510

Name of the Vulnerable Software and Affected Versions ManageWP Worker versions prior to 4.9.37 Description An authentication bypass exists because the plugin fails to bind the account being logged in to the signature that authorizes the login. Additionally, the system does not prevent the replay ...

EUVD-2026-36931

Unauthenticated Cross Site Scripting XSS in ManageWP Worker = 4.9.31 versions...

CVE-2026-39463

Unauthenticated Cross Site Scripting XSS in ManageWP Worker = 4.9.31 versions...

CVE-2026-39463

CVE-2026-39463 affects the WordPress plugin ManageWP Worker (versions

CVE-2026-39463 WordPress ManageWP Worker plugin <= 4.9.31 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in ManageWP Worker = 4.9.31 versions...

PT-2026-49374

Unauthenticated Cross Site Scripting XSS in ManageWP Worker = 4.9.31 versions...

CVE-2026-3718

The ManageWP Worker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'MWP-Key-Name' HTTP request header in all versions up to, and including, 4.9.31. This is due to insufficient input sanitization and output escaping of attacker-controlled header values. This makes it...

WordPress ManageWP Worker plugin <= 4.9.31 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by timomangcut in WordPress Plugin ManageWP Worker versions = 4.9.31...

CVE-2026-3718

The ManageWP Worker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'MWP-Key-Name' HTTP request header in all versions up to, and including, 4.9.31. This is due to insufficient input sanitization and output escaping of attacker-controlled header values. This makes it...

CVE-2026-3718

The ManageWP Worker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'MWP-Key-Name' HTTP request header in all versions up to, and including, 4.9.31. This is due to insufficient input sanitization and output escaping of attacker-controlled header values. This makes it...

CVE-2026-3718

The ManageWP Worker plugin for WordPress is affected by CVE-2026-3718: Stored Cross-Site Scripting via the MWP-Key-Name HTTP header in all versions up to 4.9.31. Root cause: insufficient input sanitization and output escaping of attacker-controlled header values. Impact: unauthenticated attackers...

WordPress plugin ManageWP Worker 跨站脚本漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The...

PT-2026-40883

The ManageWP Worker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'MWP-Key-Name' HTTP request header in all versions up to, and including, 4.9.31. This is due to insufficient input sanitization and output escaping of attacker-controlled header values. This makes it...

WordPress ManageWP Worker plugin <= 4.9.31 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Steven Julian in WordPress Plugin ManageWP Worker versions = 4.9.31...