The vulnerability arises because the ManageWP Worker plugin does not sanitize or escape the value of the ’MWP-Key-Name’ HTTP header. An attacker can inject arbitrary JavaScript into the header, which the plugin stores and later renders without proper encoding. When an administrator opens the plugin’s connection‑management page with debug parameters, the malicious script executes in the administrator’s browser. This can lead to credential theft, session hijacking, or defacement of the administrative interface.

WordPress sites that have the ManageWP Worker plugin installed, versions 4.9.31 or earlier. The vulnerability is present in all releases up to and including 4.9.31, regardless of additional WordPress configuration. Site owners using any earlier ManageWP Worker version are affected.

The CVSS score of 7.2 indicates a high impact risk, and the vulnerability can be triggered by any user who can make HTTP requests to the site, since no authentication is required to supply the malicious header. The EPSS score is not available, so the current exploitation probability is unknown, but the lack of a KEV listing suggests it has not yet been widely exploited. The likely attack vector is an unauthenticated attacker sending a crafted request with a malicious ’MWP-Key-Name’ header. Once the script is stored, it will run in the administrator’s browser whenever the debug page is loaded, potentially allowing the attacker to control the administrator’s session or manipulate the site’s content.