CVE-2026-3718 is a stored cross-site scripting vulnerability in the ManageWP Worker WordPress plugin affecting all versions up to 4.9.31. The issue stems from improper neutralization of input (CWE-79) in the 'MWP-Key-Name' HTTP request header, which is not properly sanitized or escaped before being included in web pages. This allows unauthenticated attackers to inject arbitrary JavaScript that executes in the context of the administrator's browser when they access the plugin's connection management page with debug parameters.

Successful exploitation can lead to execution of arbitrary scripts in the administrator's browser, potentially resulting in session hijacking, credential theft, or other actions performed with the administrator's privileges. The vulnerability affects confidentiality and integrity but does not impact availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid visiting the plugin's connection management page with debug parameters and consider disabling or removing the ManageWP Worker plugin if possible. Monitor vendor channels for updates and apply patches promptly once available.