[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f1N1bHN1-FzlInTWKxIgQo4H3uMvNufqp_b8ht3h0aMM":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-39463","managewp-worker-unauthenticated-stored-cross-site-scripting","ManageWP Worker \u003C= 4.9.31 - Unauthenticated Stored Cross-Site Scripting","The ManageWP Worker plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.9.31 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","worker",null,"\u003C=4.9.31","4.9.32","high",7.2,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-04-13 00:00:00","2026-04-21 14:51:09",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fbff9e7d2-b9ad-403e-a361-3e95e2c7909f?source=api-prod",9,[22,23,24,25,26,27,28,29],"init.php","readme.txt","src\u002FMWP\u002FAction\u002FDownloadFile.php","src\u002FMWP\u002FAction\u002FIncrementalBackup\u002FChecksumTables.php","src\u002FMWP\u002FEventListener\u002FMasterRequest\u002FAuthenticateServiceRequest.php","src\u002FMWP\u002FEventListener\u002FPublicRequest\u002FAddConnectionKeyInfo.php","src\u002FMWP\u002FEventListener\u002FPublicRequest\u002FBrandContactSupport.php","version","researched",false,3,"# Research Plan: ManageWP Worker Unauthenticated Stored XSS (CVE-2026-39463)\n\n## 1. Vulnerability Summary\nThe **ManageWP Worker** plugin (versions \u003C= 4.9.31) is vulnerable to **Unauthenticated Stored Cross-Site Scripting (XSS)**. The vulnerability exists because the plugin records communication errors from incoming ManageWP service requests into a WordPress option (`mwp_last_communication_error`) without proper sanitization. When a service request fails authentication (e.g., due to an invalid signature or missing public key), the plugin includes parts of the request—such as the provided public key name or the request parameters—directly in the error message. This stored error message is subsequently displayed in the WordPress admin dashboard (specifically in the connection modal or admin notices) without sufficient output escaping, allowing an unauthenticated attacker to inject malicious JavaScript.\n\n## 2. Attack Vector Analysis\n- **Endpoint**: Any page on the WordPress site (ManageWP Worker intercepts requests at the `init` or `plugins_loaded` stage).\n- **Trigger**: An incoming HTTP request containing ManageWP-specific headers that fail authentication.\n- **Vulnerable Parameter**: `MWP-Public-Key` header (mapped to `keyName`) or request parameters.\n- **Authentication Level**: Unauthenticated (no login required).\n- **Preconditions**: The plugin must be active.\n\n## 3. Code Flow\n1.  **Entry Point**: A request is made to the WordPress site with the header `MWP","The ManageWP Worker plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) via the 'mwp_last_communication_error' option. The plugin records failed authentication attempts from the ManageWP service and includes unsanitized request metadata, such as public key names or raw message contents, which are then displayed to administrators without proper escaping.","\u002F\u002F src\u002FMWP\u002FEventListener\u002FMasterRequest\u002FAuthenticateServiceRequest.php\n$keyName = $request->getKeyName();\n\nif (empty($serviceSignature) || empty($keyName)) {\n    $this->context->optionSet('mwp_last_communication_error', 'Unexpected: service signature or key name are empty. Key name: '.$keyName.', Signature: '.$serviceSignature.', Algorithm: '.($algorithm ? $algorithm : 'SHA1'));\n    return;\n}\n\n\u002F\u002F ... line 67 ...\nif (empty($publicKey)) {\n    $this->context->optionSet('mwp_last_communication_error', 'Could not find the appropriate communication key. Searched for: '.$keyName);\n    return;\n}\n\n\u002F\u002F ... line 101 ...\nif (!$verify) {\n    $this->context->optionSet('mwp_last_communication_error', 'Message signature invalid. Tried to verify: '.$messageToCheck.', Signature: '.base64_encode($serviceSignature));\n    return;\n}\n\n---\n\n\u002F\u002F src\u002FMWP\u002FEventListener\u002FPublicRequest\u002FAddConnectionKeyInfo.php\n\u003Cp>\n    \u003C?php echo 'Last communication error: '.$this->context->optionGet('mwp_last_communication_error', '') ?>\n\u003C\u002Fp>","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fworker\u002F4.9.31\u002Fsrc\u002FMWP\u002FEventListener\u002FMasterRequest\u002FAuthenticateServiceRequest.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fworker\u002F4.9.32\u002Fsrc\u002FMWP\u002FEventListener\u002FMasterRequest\u002FAuthenticateServiceRequest.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fworker\u002F4.9.31\u002Fsrc\u002FMWP\u002FEventListener\u002FMasterRequest\u002FAuthenticateServiceRequest.php\t2025-04-25 08:44:02.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fworker\u002F4.9.32\u002Fsrc\u002FMWP\u002FEventListener\u002FMasterRequest\u002FAuthenticateServiceRequest.php\t2026-03-18 13:39:12.000000000 +0000\n@@ -46,6 +46,8 @@\n         }\n \n         $algorithm = $request->getSignatureAlgorithm();\n+        \u002F\u002F Sanitize algorithm to prevent XSS when displayed in debug output\n+        $sanitizedAlgorithm = sanitize_text_field($algorithm);\n \n         if ($algorithm == 'SHA256') {\n             $serviceSignature = $request->getServiceSignatureV2();\n@@ -56,9 +58,11 @@\n         }\n \n         $keyName = $request->getKeyName();\n+        \u002F\u002F Sanitize key name to prevent XSS when displayed in debug output\n+        $sanitizedKeyName = sanitize_text_field($keyName);\n \n         if (empty($serviceSignature) || empty($keyName)) {\n-            $this->context->optionSet('mwp_last_communication_error', 'Unexpected: service signature or key name are empty. Key name: '.$keyName.', Signature: '.$serviceSignature.', Algorithm: '.($algorithm ? $algorithm : 'SHA1'));\n+            $this->context->optionSet('mwp_last_communication_error', 'Unexpected: service signature or key name are empty. Key name: '.$sanitizedKeyName.', Signature: '.$serviceSignature.', Algorithm: '.($sanitizedAlgorithm ? $sanitizedAlgorithm : 'SHA1'));\n             return;\n         }\n \n@@ -67,7 +71,7 @@\n         if (empty($publicKey)) {\n             \u002F\u002F for now do not throw an exception, just do not authenticate the request\n             \u002F\u002F later we should start throwing an exception here when this becomes the main communication method\n-            $this->context->optionSet('mwp_last_communication_error', 'Could not find the appropriate communication key. Searched for: '.$keyName);\n+            $this->context->optionSet('mwp_last_communication_error', 'Could not find the appropriate communication key. Searched for: '.$sanitizedKeyName);\n             return;\n         }\n \n@@ -75,7 +79,7 @@\n         $messageToCheck   = '';\n \n         if (empty($communicationKey)) {\n-            $this->context->optionSet('mwp_last_communication_error', 'Unexpected: communication key is empty. Key name: '.$keyName);\n+            $this->context->optionSet('mwp_last_communication_error', 'Unexpected: communication key is empty. Key name: '.$sanitizedKeyName);\n             return;\n         }\n \n@@ -88,7 +92,7 @@\n         if (empty($messageToCheck)) {\n             \u002F\u002F for now do not throw an exception, just do not authenticate the request\n             \u002F\u002F later we should start throwing an exception here when this becomes the main communication method\n-            $this->context->optionSet('mwp_last_communication_error', 'Unexpected: message to check is empty. Host: '.$request->server['HTTP_HOST']);\n+            $this->context->optionSet('mwp_last_communication_error', 'Unexpected: message to check is empty. Host: '.sanitize_text_field($request->server['HTTP_HOST']));\n             return;\n         }\n \n@@ -101,7 +105,7 @@\n         if (!$verify) {\n             \u002F\u002F for now do not throw an exception, just do not authenticate the request\n             \u002F\u002F later we should start throwing an exception here when this becomes the main communication method\n-            $this->context->optionSet('mwp_last_communication_error', 'Message signature invalid. Tried to verify: '.$messageToCheck.', Signature: '.base64_encode($serviceSignature));\n+            $this->context->optionSet('mwp_last_communication_error', 'Message signature invalid. Tried to verify: '.base64_encode($messageToCheck).', Signature: '.base64_encode($serviceSignature));\n             return;\n         }\n\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fworker\u002F4.9.31\u002Fsrc\u002FMWP\u002FEventListener\u002FPublicRequest\u002FAddConnectionKeyInfo.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fworker\u002F4.9.32\u002Fsrc\u002FMWP\u002FEventListener\u002FPublicRequest\u002FAddConnectionKeyInfo.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fworker\u002F4.9.31\u002Fsrc\u002FMWP\u002FEventListener\u002FPublicRequest\u002FAddConnectionKeyInfo.php\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fworker\u002F4.9.32\u002Fsrc\u002FMWP\u002FEventListener\u002FPublicRequest\u002FAddConnectionKeyInfo.php\n@@ -410,21 +410,28 @@\n                     if ($refreshedKeys['success'] === true) {\n                         echo 'Keys successfully refreshed!';\n                     } else {\n-                        echo 'Keys were not successfully refreshed. Error: '.$refreshedKeys['message'];\n+                        echo 'Keys were not successfully refreshed. Error: '.esc_html($refreshedKeys['message']);\n                     } ?>\n                 \u003C\u002Fp>\n                 \u003Cp>\n-                    \u003C?php echo 'Last communication error: '.$this->context->optionGet('mwp_last_communication_error', '') ?>\n+                    \u003C?php echo 'Last communication error: '.esc_html($this->context->optionGet('mwp_last_communication_error', '')) ?>\n                 \u003C\u002Fp>","To exploit this vulnerability, an unauthenticated attacker sends a crafted HTTP request containing ManageWP-specific headers, such as 'MWP-Public-Key', with a malicious JavaScript payload (e.g., \u003Cscript>alert(1)\u003C\u002Fscript>). By purposefully omitting or invalidating the 'MWP-Signature' header, the attacker triggers an authentication failure. The plugin's AuthenticateServiceRequest listener captures the failure and saves the error message—including the malicious header value—into the 'mwp_last_communication_error' WordPress option. When a site administrator later visits the plugin's connection management interface (typically via plugins.php?worker_connections=1), the stored payload is rendered without escaping, resulting in script execution in the administrator's browser context.","gemini-3-flash-preview","2026-04-27 14:58:44","2026-04-27 14:59:34",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","4.9.31","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fworker\u002Ftags\u002F4.9.31","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fworker.4.9.31.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fworker\u002Ftags\u002F4.9.32","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fworker.4.9.32.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fworker\u002Ftags"]