ManageWP Worker Stored XSS via HTTP Header Injection

The ManageWP Worker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'MWP-Key-Name' HTTP request header in all versions up to, and including, 4.9.31. This is due to insufficient input sanitization and output escaping of attacker-controlled header values. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator visits the plugin's connection management page with debug parameters.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The ManageWP Worker plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in versions up to 4.9.31, where the 'MWP-Key-Name' HTTP request header is insufficiently sanitized and escaped before being rendered on the plugin's connection management page. This vulnerability is particularly critical because it requires no authentication—any attacker can inject malicious scripts that persist and execute whenever administrators access the affected page with debug parameters enabled. Given that WordPress powers over 40% of websites, and ManageWP is a widely-used management tool trusted by site administrators, this vulnerability exposes thousands of websites to account compromise, malware injection, and administrative control hijacking.

Casky.ai's 301 matching skills leverage Claude's extended reasoning to detect the attack chain across MITRE ATT&CK Initial Access (TA0001) and Resource Development (TA0043) techniques. Practitioners using Casky would identify detection opportunities at multiple stages: header-based payload injection patterns in web access logs, stored script detection in database queries and page content analysis, and suspicious admin page access with unusual parameter combinations. The platform's skills map both the reconnaissance phase—where attackers probe for the vulnerable header parameter—and the exploitation phase where malicious payloads are injected. Security teams would see findings highlighting unescaped header values in plugin code, stored script detection in page rendering, and browser-side execution warnings, enabling them to prioritize immediate patching of ManageWP Worker and implement Web Application Firewall rules to block malicious 'MWP-Key-Name' header values before they reach vulnerable systems.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-3718.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-3718

Casky has 301 skills that investigate the attack patterns behind CVE-2026-3718. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn