CVE-2026-1074
Stored XSS in WP App Bar Plugin Allows Admin Settings Injection
Publication date: 2026-03-07
Last updated on: 2026-03-07
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordfence | wp_app_bar | to 1.5 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The WP App Bar plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in the 'app-bar-features' parameter in all versions up to and including 1.5.
This vulnerability arises because the plugin does not properly sanitize input or escape output, and it lacks an authorization check in the App_Bar_Settings class constructor.
As a result, unauthenticated attackers can inject malicious scripts into multiple plugin settings, which will execute whenever a user accesses the admin settings page.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': "This vulnerability involves stored Cross-Site Scripting (XSS) via the 'app-bar-features' parameter in the WP App Bar plugin settings. Detection involves checking if the plugin is installed and if the vulnerable versions (up to and including 1.5) are in use."}, {'type': 'paragraph', 'content': "Since the vulnerability allows injection of arbitrary scripts into plugin settings that execute on the admin settings page, detection can include inspecting the stored 'app-bar-features' option in the WordPress database for suspicious or unexpected script content."}, {'type': 'paragraph', 'content': 'Suggested commands to detect potential exploitation or presence of malicious scripts include:'}, {'type': 'list_item', 'content': "Use a database query to check the 'app-bar-features' option in the WordPress options table for suspicious content, for example (assuming MySQL):"}, {'type': 'list_item', 'content': "SELECT option_value FROM wp_options WHERE option_name = 'app-bar-features';"}, {'type': 'list_item', 'content': 'Inspect the output for any injected JavaScript or unexpected serialized data.'}, {'type': 'list_item', 'content': 'Check the plugin version installed on the WordPress site by running:'}, {'type': 'list_item', 'content': 'wp plugin list | grep wp-app-bar'}, {'type': 'list_item', 'content': "Monitor HTTP requests to the admin settings page for suspicious payloads or unexpected POST requests containing the 'app-bar-features' parameter."}] [2]
How can this vulnerability impact me? :
This vulnerability can allow attackers to execute arbitrary web scripts in the context of the WordPress admin settings page.
Because the attack can be performed by unauthenticated users, it increases the risk of unauthorized actions such as stealing admin credentials, performing actions on behalf of administrators, or injecting malicious content.
The CVSS score of 7.2 indicates a high severity with network attack vector, no privileges required, and no user interaction needed, making it a serious threat.
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'Immediate mitigation steps include:'}, {'type': 'list_item', 'content': 'Update the WP App Bar plugin to a version later than 1.5 where the vulnerability is fixed, if such an update is available.'}, {'type': 'list_item', 'content': 'If an update is not available, temporarily disable or uninstall the WP App Bar plugin to prevent exploitation.'}, {'type': 'list_item', 'content': "Manually inspect and clean the 'app-bar-features' option in the WordPress database to remove any injected malicious scripts."}, {'type': 'list_item', 'content': 'Restrict access to the WordPress admin settings page to trusted users only, as the vulnerability executes scripts when the admin settings page is accessed.'}, {'type': 'list_item', 'content': "Implement Web Application Firewall (WAF) rules to block suspicious POST requests targeting the 'app-bar-features' parameter."}] [2]