The vulnerability is a Cross‑Site Request Forgery flaw that allows an attacker to inject persistent malicious scripts into the WordPress Admin Bar Improved plugin. Because the plugin stores the injected payload, the flaw can lead to stored XSS, enabling an attacker to execute arbitrary code in an administrator’s browser, potentially stealing credentials or tracking users. The weakness is identified as CWE‑352.

The vulnerability impacts the Donald Gilbert WordPress Admin Bar Improved plugin up to and including version 3.3.5. Any WordPress installation running this plugin version is susceptible.

The CVSS score of 7.1 indicates high severity. The EPSS value is less than 1 % and the issue is not listed in the CISA KEV catalog, suggesting a low probability of exploitation in the near term. Based on the description, it is inferred that exploitation would require an administrator to be tricked into visiting a crafted URL or page that submits a CSRF payload. Once the malicious script is stored, it will execute on every subsequent visit by that administrator’s browser.