CVE-2026-39463: WordPress ManageWP Worker plugin <= 4.9.31 - Cross Site Scripting (XSS) vulnerability

Synopsis

A reflected or stored cross-site scripting (XSS) vulnerability affects the ManageWP Worker WordPress plugin at version 4.9.31 and earlier. It is exploitable over the network with no authentication required, but a victim must be social-engineered into triggering the malicious request. Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the victim's browser, enabling session theft, UI redirection, and limited data tampering. No upstream fix has been published; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the vulnerable WordPress service over the network to deliver the malicious payload.

• AuthenticationNot required

  No account or credentials are needed; the attack can be launched by any unauthenticated party.

• Victim interactionRequired

  A logged-in user (typically an administrator or editor) must be induced to click a crafted link or visit a page containing the injected payload for the attack to succeed.

• Attack complexityDetail

  The exploit is reliable and requires no special race conditions or environmental prerequisites beyond delivering the malicious request to the victim.

Blast Radius

• Reads browser session cookies and authentication tokens belonging to the victim, enabling account takeover of the affected WordPress user.
• Injects content or redirects into the victim's browser session, allowing UI manipulation or phishing within the trusted site origin.
• Performs limited unauthorized modifications through the victim's session, such as publishing or altering WordPress content on their behalf.