The Easy Custom Admin Bar plugin accepts a "msg" query parameter without proper sanitization or escaping. An attacker can embed arbitrary script payloads that are reflected back in the page and executed in the victim’s browser. Because the vulnerability is triggered by a crafted URL, no authentication is required and it can lead to session hijacking, cookie theft, or phishing attempts while the victim is logged into WordPress. The weakness is described by CWE‑79.

All WordPress sites that use the duogeek Easy Custom Admin Bar plugin, version 1.0 or earlier. No specific WordPress core version is mentioned, so the flaw applies to any installation of the plugin regardless of the surrounding environment.

The CVSS score of 6.1 indicates a moderate severity vulnerability. The EPSS score of less than 1 % suggests a very low exploitation probability at present, and the flaw is not listed in CISA’s KEV catalog. Nonetheless, the attack can be launched from any remote web server by creating a URL that the target user clicks on. Because the payload executes in the authenticated context of the victim, the impact on confidentiality, integrity, and availability can be significant once the script is delivered.