---
id: CVE-2026-10083
title: >-
  The APCu Manager WordPress plugin before 4.5.0 does not escape APCu
  object-cache keys before rendering them in an admin-area page, leading to a
  Stored Cross-Site Scripting vulnerability
summary: >-
  The APCu Manager WordPress plugin before 4.5.0 does not escape APCu
  object-cache keys before rendering them in an admin-area page, leading to a
  Stored Cross-Site Scripting vulnerability. When a persistent object cache is
  enabled, cache k…
severity: none
published: '2026-06-29'
updated: '2026-06-29'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-10083'
references:
  - url: 'https://wpscan.com/vulnerability/e591b3f3-6e21-44f7-b374-4753689532fe/'
    label: contact@wpscan.com
tags:
  - nvd
ingestedAt: '2026-06-29T13:42:12.360Z'
epss: 0.00352
epssPercentile: 0.28964
---

## Overview

The APCu Manager WordPress plugin before 4.5.0 does not escape APCu object-cache keys before rendering them in an admin-area page, leading to a Stored Cross-Site Scripting vulnerability. When a persistent object cache is enabled, cache keys derived from unsanitised user input (e.g. a transient name created by another APCu Manager WordPress plugin before 4.5.0 from an unauthenticated request) are output without escaping and execute arbitrary JavaScript in the session of an administrator viewing the page.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.