The WP Darko Top Bar plugin versions up to 3.0.5 contain a stored cross-site scripting vulnerability (CWE-79) due to improper input neutralization during web page generation. This flaw allows an attacker with high privileges and user interaction to inject malicious scripts that can execute in the context of other users, potentially leading to partial confidentiality, integrity, and availability impacts. The vulnerability has a CVSS 3.1 base score of 5.9, reflecting network attack vector, low attack complexity, required privileges, user interaction, and a scope change with limited impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker with high privileges to inject malicious scripts that execute in other users' browsers, potentially leading to partial disclosure of information, modification of data, or disruption of service. However, the impact is limited due to the requirement for privileges and user interaction. No known active exploitation has been reported.

No official patch or remediation is currently available for this vulnerability. Users of WP Darko Top Bar should monitor the vendor's official channels for updates and apply any forthcoming patches promptly. Until a fix is released, restricting access to high-privilege accounts and limiting user interactions with untrusted content may reduce risk.