APCu Manager < 4.5.0 - Unauthenticated Stored XSS via Cache Key Pollution

Description

The plugin does not escape APCu object-cache keys before rendering them in an admin-area page, leading to a Stored Cross-Site Scripting vulnerability. When a persistent object cache is enabled, cache keys derived from unsanitised user input (e.g. a transient name created by another plugin from an unauthenticated request) are output without escaping and execute arbitrary JavaScript in the session of an administrator viewing the page.