WittyFolk Bonjour Bar plugin allows stored cross‑site scripting due to improper neutralization of user input before rendering web pages. This flaw enables an attacker to inject arbitrary JavaScript that will execute when any user, including administrators, view a page containing the malicious payload, potentially leading to credential theft, defacement, or further compromise.

The vulnerability affects all installations of the Bonjour Bar plugin from unspecified earlier releases through version 1.0.0. Any WordPress site that has not upgraded beyond 1.0.0 and still uses the plugin is susceptible.

The CVSS score of 5.9 indicates a moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation, and the flaw is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is through the plugin’s storage of malicious input, which may be entered via an authenticated administrative interface but could potentially be exposed to broader users depending on how the plugin’s output is rendered.