The Frndzk Expandable Bottom Bar WordPress plugin contains a stored cross‑site scripting vulnerability via the text parameter. In affected versions through 1.0, insufficient input sanitization allows an authenticated administrator to inject arbitrary JavaScript into the plugin’s output. When a user views a page where the script is stored, the malicious code executes in the context of that user’s browser, potentially exposing session information or defacing the site.

WordPress sites running the Frndzk Expandable Bottom Bar plugin up to and including version 1.0 on multi‑site networks or sites with the unfiltered_html capability disabled. Only accounts with administrator or higher privileges can exploit the flaw.

The CVSS score of 5.5 indicates a moderate severity, while the EPSS score of less than 1% suggests that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Because the attacker must first authenticate as an administrator, the attack vector is limited to users with elevated privileges, reducing the overall risk profile for anonymous users.