The AdminQuickbar plugin for WordPress contains a vulnerability that fails to neutralize user‑controlled input, allowing malicious scripts to be reflected into page markup. This reflected Cross‑Site Scripting (XSS) flaw, identified as CWE‑79, can execute arbitrary code in the browser context of any user who views a page that incorporates the plugin, potentially leading to session hijacking, defacement, or redirect to malicious sites.

WordPress sites running the rtowebsites AdminQuickbar plugin version 1.9.1 or earlier are vulnerable. All releases through 1.9.1 lack the necessary input sanitization and should be considered at risk until a later version is deployed.

The CVSS score of 7.1 reflects moderate‑to‑high risk, while the EPSS score of less than 1% indicates a very low current likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker can craft a URL containing malicious input that is reflected in the plugin’s output, requiring the victim to click or otherwise load the URL from the affected admin area; the attack is therefore likely to be targeted rather than widespread.