The Custom Admin-Bar Favorites plugin for WordPress suffers from a reflected XSS vulnerability (CWE-79) due to improper neutralization of the 'menuObject' parameter. This allows unauthenticated remote attackers to inject and execute arbitrary web scripts by persuading users to interact with malicious links. The vulnerability affects all versions up to and including 0.1. The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, scope changed, and low confidentiality and integrity impacts without availability impact. There is no vendor advisory or patch available at this time.

Successful exploitation can lead to execution of arbitrary scripts in the context of the victim's browser session, potentially allowing theft of user credentials, session tokens, or other sensitive information accessible via the browser. The vulnerability requires user interaction and does not grant direct system access or availability disruption. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid clicking on untrusted links that could exploit this vulnerability. Administrators should monitor for updates from the plugin vendor or WordPress security channels and apply patches promptly once released.