ManageWP Worker, a remote site management plugin with over 1 million active installations, contains a stored cross-site scripting vulnerability in versions prior to 4.9.32. If you’re running an older version and have ManageWP connected to your site, an attacker with access to your ManageWP account could inject malicious JavaScript that executes in your WordPress admin dashboard.
What’s the vulnerability?
The plugin allows ManageWP account holders to customise branding text (things like support contact information) that appears in the WordPress admin footer. The problem is that this text is stored without sanitisation and output without escaping.
Here’s the vulnerable code path:
- The ManageWP API sends branding data to the plugin
- The plugin stores it directly in the WordPress options table without cleaning it
- When an admin opens the support dialog, the text is echoed straight into the HTML:
<p><?php echo $contactText ?></p>No esc_html(), no wp_kses_post(). Just raw output.
How could an attacker exploit this?
If someone compromises your ManageWP account, they can inject JavaScript into that branding field. Something like:
<img src=x onerror="fetch('/wp-admin/user-new.php', {method: 'POST', body: new FormData(...)})">When you log into your WordPress admin and open the support dialog, that script runs in your browser. From there, an attacker could:
- Create new admin accounts for persistent access
- Steal your session cookies
- Modify plugin settings or inject backdoors
- Exfiltrate sensitive data
The payload persists in your database, so it executes every time an admin opens that dialog.
How do I check if I’m affected?
First, check your ManageWP Worker version. Go to Plugins in your WordPress admin and look for “Worker”. If you’re running version 4.9.31 or earlier, you’re vulnerable.
You can also check the database directly:
wp option get mwp_worker_brandIf that returns data with suspicious HTML or JavaScript, someone may have already exploited this.
What should I do?
Update immediately. ManageWP released version 4.9.32 on 16 April 2026 with the fix. Go to Plugins → Updates and update ManageWP Worker.
After updating:
- Review your WordPress user accounts for any unexpected admin users
- Check your server access logs for suspicious activity around the time you were running the vulnerable version
- If you suspect compromise, consider rotating your ManageWP account password and reviewing what permissions it has
Why does this matter?
ManageWP is a powerful tool: it lets you manage multiple WordPress sites from a central dashboard. That power means a compromised ManageWP account is a serious problem. This vulnerability turns that account compromise into direct access to your WordPress admin environment.
With 1 million installations, this is the kind of vulnerability that gets exploited at scale. If you’re running an older version, update now.
Tools like Vulnz can monitor your plugins and alert you when vulnerabilities like this are disclosed, so you’re not caught off-guard.