The WP App Bar plugin for WordPress contains a Stored Cross-Site Scripting vulnerability that allows unauthenticated attackers to execute arbitrary web scripts in the administrator dashboard.

This flaw exists within the App_Bar_Settings class constructor, where improper input sanitization and a missing capability check allow unauthenticated attackers to inject malicious scripts into plugin settings. These scripts execute whenever an administrator accesses the affected settings page.

Successful exploitation of this vulnerability poses a significant risk to the integrity of the WordPress administrative interface. Since the injected scripts execute within the context of an administrator session, an attacker could potentially perform unauthorized administrative actions, steal session cookies, or redirect users to malicious domains. Given the CVSS score of 7.2, this vulnerability is classified as High severity due to its potential for full administrative compromise of the plugin settings and the lack of required authentication.

Immediate Action: Because no patched version is currently confirmed, administrators should immediately deactivate and uninstall the WP App Bar plugin until a secure update is released by the developer.

Proactive Monitoring: Monitor server access logs and database audit logs for suspicious POST requests directed at the WordPress administrative settings endpoints.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block malicious XSS payloads, specifically targeting the app-bar-features parameter.

Public Exploit Available: Unknown

The vulnerability represents a critical security gap for any WordPress environment utilizing the WP App Bar plugin. Organizations must prioritize the removal of this plugin to eliminate the attack vector. If the functionality is essential, keep the plugin deactivated until the vendor provides a version that includes both proper input sanitization and mandatory capability checks for administrative functions.