Executive brief
The ManageWP Worker plugin, used to connect WordPress sites to the ManageWP management dashboard, is vulnerable to a security flaw that allows attackers to inject malicious scripts. By sending a specially crafted web request, an unauthenticated attacker can store a script that triggers when a site administrator views specific management pages. This could lead to unauthorized actions being performed on behalf of the administrator, potentially compromising the website's security or data.
Technical details
The ManageWP Worker plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping of the 'MWP-Key-Name' HTTP request header. An unauthenticated attacker can send a request containing malicious JavaScript in this header, which is then stored by the plugin. The script executes in the context of an administrative user's browser session when they visit the plugin's connection management page while debug parameters are active. This vulnerability is present in all versions up to and including 4.9.31 and has been addressed in subsequent updates.
Affected products
- GoDaddy ManageWP Worker up to, and including, 4.9.31
Timeline
- 2026-05-14: disclosed
- 2026-05-14: advisory