The Custom Admin‑Bar Favorites WordPress plugin, versions up to and including 0.1, accepts a user‑supplied parameter called menuObject that is neither properly sanitized nor escaped. This allows an attacker to inject arbitrary client‑side scripts when the parameter value is reflected in the page response. An unauthenticated attacker can therefore exploit the vulnerability simply by luring a victim to a crafted URL, leading to the execution of malicious JavaScript in the victim’s browser. The impact includes theft of session cookies, credential phishing, or other malicious actions performed on behalf of the user. The weakness is a classic reflected Cross‑Site Scripting flaw identified as CWE‑79.

Any WordPress site that has installed the Custom Admin‑Bar Favorites plugin with a version 0.1 or earlier is affected. The vulnerability exists in the plugin’s menu handling code and is triggered by the menuObject query string parameter present in the browser request. The plugin is distributed under the codeandreload vendor and can be found in the WordPress plugin repository or other third‑party listings.

The CVSS score of 6.1 indicates moderate severity. The EPSS rating of less than 1% suggests that exploitation is currently considered unlikely. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a web‑based malicious link that a user may click; exploiting it requires no authentication or privilege escalation, making the attack relatively accessible to casual threat actors.