CVE-2026-1074

Description

The WP App Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'app-bar-features' parameter in all versions up to, and including, 1.5. This is due to insufficient input sanitization and output escaping combined with a missing authorization check in the `App_Bar_Settings` class constructor. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into multiple plugin settings that will execute whenever a user accesses the admin settings page.

PUBLISHED Reserved 2026-01-16 | Published 2026-03-07 | Updated 2026-03-07 | Assigner Wordfence

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

Timeline

Credits

Bhumividh Treloges finder

References

www.wordfence.com/...-b989-453f-9acb-5556e01e41a4?source=cve

plugins.trac.wordpress.org/...des/class-app-bar-settings.php

plugins.trac.wordpress.org/...des/class-app-bar-settings.php

cve.org (CVE-2026-1074)

nvd.nist.gov (CVE-2026-1074)

Download JSON