CVE-2026-10083: APCu Manager WordPress Plugin Stored XSS Vulnerability

Technical summary

The vulnerability exists because APCu Manager fails to escape APCu object-cache keys before rendering them on admin-area pages. Cache keys can be populated from unsanitized user input—for example, transient names created through unauthenticated requests to the plugin—and these keys are output directly to HTML without escaping. Because the cache persists across requests, the payload remains in the object cache until manually flushed, making this a stored XSS rather than a reflected variant. The attack requires that persistent object caching be enabled and that an admin view the affected page after malicious cache keys have been set.

Business impact

Administrator accounts are the primary target, and compromise at that level can lead to installation-wide damage: modification of site content, installation of malicious plugins, user account creation, or data exfiltration. The stored nature of the vulnerability means the attack persists invisibly until the cache is flushed, and every administrator who views the affected page during that window becomes a potential victim. WordPress sites relying on APCu for performance optimization are disproportionately at risk.

Affected systems

WordPress installations using the APCu Manager plugin version 4.4.9 or earlier. The vulnerability only manifests when persistent object caching is enabled. Sites using external cache backends or no persistent caching are not affected. The plugin is actively maintained; version 4.5.0 and later contain the fix.

Exploitability

Exploitation requires an attacker to inject malicious input into a cache key—typically through an unauthenticated request that creates a transient or similar cache entry. No special privileges are needed to poison the cache. However, the attack does depend on an administrator visiting the plugin's admin page after the cache has been polluted, and the payload must survive until that visit. Network accessibility is required, and the attack succeeds only if object caching is enabled. The CVSS score of 7.5 (HIGH) reflects high confidentiality and integrity impact but the additional constraint that user interaction (admin page view) is required.

Remediation

Update APCu Manager to version 4.5.0 or later immediately. This version includes proper escaping of cache keys in admin output. Verify the update is applied by checking the plugin version in WordPress admin or via the plugin file header. As an interim measure pending patching, disable persistent object caching or restrict admin page access via firewall or authentication rules if feasible, though these are not substitutes for patching.

Patch guidance

Patch version 4.5.0 or later is required. Administrators should navigate to Plugins > Installed Plugins in WordPress admin, locate APCu Manager, and click 'Update' if available. Alternatively, update via command line or WordPress administrative REST API if automation is in place. After updating, verify the new version is active and consider flushing the object cache to clear any potentially malicious keys that may have accumulated. Test admin pages to ensure no JavaScript errors occur post-update.

Detection guidance

Monitor object-cache contents for anomalous transient or cache-key names containing JavaScript payloads, HTML tags, or encoded special characters. Web application firewalls (WAF) can detect and block requests attempting to inject such keys if a parameter-injection pattern is known. Review admin access logs for unusual patterns of admin page visits by the same IP or user immediately after request bursts to transient-creation endpoints. APCu Manager itself may log admin page access; correlate timestamps between cache operations and admin page views to identify attack sequences.

Why prioritize this

Stored XSS targeting administrators justifies immediate patching due to the high-privilege nature of WordPress admin accounts. The attack requires no special permissions to trigger and affects any site with APCu caching enabled. Although the vulnerability is not yet on the KEV catalog, the attack surface is broad and the damage potential is severe. Prioritize this among WordPress plugin updates.

Risk score, explained

The CVSS 7.5 HIGH score reflects the combination of high confidentiality and integrity impact (C:H, I:H, A:H) against admin context, moderated by the attack vector requiring network access but with some network complexity (AC:H) and mandatory user interaction (UI:R). The lack of privilege escalation requirement (PR:N) and limited scope (S:U) yield the score. For organizations running APCu caching, the practical risk is elevated because exploitation is feasible with minimal attacker sophistication.

Frequently asked questions