The WP App Bar plugin contains a stored cross‑site scripting vulnerability caused by insufficient sanitization of the app‑bar‑features parameter and a missing authorization check in the settings constructor. Because the input is not validated and output is not escaped, an attacker can store malicious JavaScript in the plugin’s settings. When an administrator later accesses the settings page, the stored script is injected into the page and executed in the context of the administrator’s browser session.

Any WordPress installation that has the WP App Bar plugin up to and including version 1.5 is affected. The flaw resides entirely in the plugin code; the WordPress core version does not influence the vulnerability. Site owners should verify the installed version and determine if the plugin is present.

The CVSS score of 7.2 indicates a high severity flaw. The EPSS score being below 1 % indicates a low probability of exploitation in the wild. The flaw is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker can inject and store JavaScript through the app‑bar‑features field, which is then executed whenever an administrator visits the plugin’s settings page. This execution occurs in the administrator’s browser context and could expose that session to further malicious actions. The risk is therefore limited to administrative accounts, but successful exploitation could allow the attacker to carry out any activity that the administrator can perform.