First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-39463

HighCVSS 7.1/10Last modified Oct 25, 2026

Description

Unauthenticated Cross Site Scripting (XSS) in ManageWP Worker <= 4.9.31 versions.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Weakness enumeration

Affected software

Vendor	Product	Versions
ManageWP	ManageWP Worker	<= 4.9.31

References

https://patchstack.com/database/wordpress/plugin/worker/vulnerability/wordpress-managewp-worker-plugin-4-9-31-cross-site-scripting-xss-vulnerability?_s_id=cve

Timeline

Published: Jun 15, 2026
Last modified: Oct 25, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-394645.5Server-Side Request Forgery (SSRF) vulnerability in SeedProd Coming Soon Page, Under Construction & Maintenance Mode by SeedProd coming-soon CVE-2026-394659.1Editor Remote Code Execution (RCE) in Responsive Slider by MetaSlider <= 3.106.0 versions.CVE-2026-394667.6Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPMU DEV - Your All-in-One WordPress P CVE-2026-394677.2Deserialization of Untrusted Data vulnerability in MetaSlider Responsive Slider by MetaSlider allows Object Injection.This issue affects Res CVE-2026-394686.8Contributor Arbitrary File Deletion in Meta Box – WordPress Custom Fields Framework <= 5.11.1 versions.CVE-2026-394694.3Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Softaculous PageLayer pagelayer allows Retrieve CVE-2026-394707.2Shop manager Privilege Escalation in WooCommerce Cart Abandonment Recovery < 2.1.0 versions.CVE-2026-394717.2Author PHP Object Injection in ShortPixel Image Optimizer <= 6.4.3 versions.CVE-2026-394727.2Shop manager PHP Object Injection in WooCommerce PDF Invoices & Packing Slips < 5.9.0 versions.CVE-2026-394735.3Insertion of Sensitive Information Into Sent Data vulnerability in Pär Thernström Simple History simple-history allows Retrieve Embedded Sen CVE-2026-394748.8Contributor PHP Object Injection in Post Duplicator <= 3.0.10 versions.CVE-2026-394757.6Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Syed Balkhi User Feedback userfeedback

CVE-2026-39463: High severity, CVSS 7.1 | Vulnix