CVE-2026-10083 is a stored Cross-Site Scripting vulnerability in the APCu Manager WordPress plugin versions prior to 4.5.0. The vulnerability arises from the plugin's failure to escape APCu object-cache keys before rendering them in an admin-area page. When persistent object caching is enabled, an attacker can craft cache keys from unsanitized user input (such as transient names created by unauthenticated requests) that are stored and later rendered without proper escaping. This allows execution of arbitrary JavaScript in the context of an administrator's session, potentially leading to session hijacking or other malicious actions.

An attacker can inject malicious JavaScript that executes in the browser session of an administrator viewing the affected admin page. This can lead to session hijacking, privilege escalation, or other attacks that rely on executing scripts in the administrator's context. The vulnerability requires that persistent object caching is enabled and that an attacker can influence cache keys stored by the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling persistent object caching or avoid using the APCu Manager plugin versions prior to 4.5.0. Monitoring for updates from the plugin vendor is recommended to apply an official fix once released.