APCu Manager < 4.5.0 Unauthenticated Stored XSS via Cache Key Pollution

CVE-2026-10083 is a stored cross-site scripting (XSS) flaw in the APCu Manager WordPress plugin, versions prior to 4.5.0. The plugin renders APCu object-cache keys on its admin-area Tools page without escaping them. An unauthenticated attacker can poison a cache key — typically by abusing a *second* co-installed plugin that creates WordPress transients from raw user input via an unauthenticated AJAX endpoint — and inject a JavaScript payload (e.g., <svg/onload=alert(1)>) that fires when an administrator navigates to the APCu Manager Tools page. Successful exploitation yields JavaScript execution in the admin's browser session, which can be escalated to full WordPress admin-account takeover, backdoor plugin installation, and site compromise.

The vendor CVSS of 7.5 HIGH (AC:H/PR:N/UI:R) overestimates real-world risk significantly. The score correctly flags the unauthenticated entry point and the admin-session impact, but it cannot express the compounding gate conditions: the plugin has only ~10,000 active installations globally, the PHP APCu extension must be installed and enabled (non-default on most hosting), a persistent object cache must be active, a *separate* plugin must create cache keys from unsanitized unauthenticated input, and the admin must specifically visit the niche APCu Manager page. Each gate dramatically narrows the exploitable population. The impact ceiling is a single WordPress instance — there is no domain, fleet, or supply-chain multiplier. A MEDIUM 4.5 assessment better reflects the real-world exposure.

Sources.

1. WPScan Advisory — APCu Manager < 4.5.0 Stored XSS
2. NVD — CVE-2026-10083
3. OpenCVE — CVE-2026-10083
4. WordPress.org — APCu Manager Plugin Page
5. CyberStrike — CVE-2026-10083 Detail
6. GitHub — Pierre-Lannoy/wp-apcu-manager
7. Fastly — Active Exploitation of WP Stored XSS Vulnerabilities
8. Hol — CVE-2026-10083 Analysis

Run this script on the WordPress host (or any machine with SSH/file access to the WordPress installation directory). Invoke as: bash check_cve_2026_10083.sh /var/www/html/wordpress. Requires read access to the WordPress wp-content/plugins directory. No root needed.

#!/usr/bin/env bash
# check_cve_2026_10083.sh — Detect CVE-2026-10083 (APCu Manager < 4.5.0 Stored XSS)
# Usage: bash check_cve_2026_10083.sh /path/to/wordpress
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

WP_ROOT="${1:-/var/www/html}"
PLUGIN_DIR="$WP_ROOT/wp-content/plugins/apcu-manager"
MAIN_FILE="$PLUGIN_DIR/apcu-manager.php"
FIXED_MAJOR=4
FIXED_MINOR=5
FIXED_PATCH=0

if [ ! -d "$PLUGIN_DIR" ]; then
  echo "PATCHED — APCu Manager plugin is not installed at $PLUGIN_DIR"
  exit 0
fi

if [ ! -f "$MAIN_FILE" ]; then
  echo "UNKNOWN — Plugin directory exists but main file not found: $MAIN_FILE"
  exit 2
fi

# Extract version from the plugin header
VERSION=$(grep -i '^[[:space:]]*\*[[:space:]]*Version:' "$MAIN_FILE" | head -1 | sed 's/.*Version:[[:space:]]*//' | tr -d '[:space:]')

if [ -z "$VERSION" ]; then
  echo "UNKNOWN — Could not extract version from $MAIN_FILE"
  exit 2
fi

# Parse major.minor.patch
IFS='.' read -r VMAJ VMIN VPAT <<< "$VERSION"
VMAJ=${VMAJ:-0}
VMIN=${VMIN:-0}
VPAT=${VPAT:-0}

echo "Detected APCu Manager version: $VERSION"

if [ "$VMAJ" -gt "$FIXED_MAJOR" ] 2>/dev/null; then
  echo "PATCHED — Version $VERSION >= 4.5.0"
  exit 0
elif [ "$VMAJ" -eq "$FIXED_MAJOR" ] 2>/dev/null; then
  if [ "$VMIN" -gt "$FIXED_MINOR" ] 2>/dev/null; then
    echo "PATCHED — Version $VERSION >= 4.5.0"
    exit 0
  elif [ "$VMIN" -eq "$FIXED_MINOR" ] 2>/dev/null; then
    if [ "$VPAT" -ge "$FIXED_PATCH" ] 2>/dev/null; then
      echo "PATCHED — Version $VERSION >= 4.5.0"
      exit 0
    fi
  fi
fi

echo "VULNERABLE — APCu Manager $VERSION is below 4.5.0 (CVE-2026-10083)"
exit 1