CVE-2026-10083

The CVE concerns the APCu Manager WordPress plugin prior to version 4.5.0. The root cause is that APCu object-cache keys are not escaped before rendering in an admin page, enabling a Stored XSS when a persistent object cache is used. Cache keys derived from unsanitised user input (e.g., a transie...