CVE-2026-1074 is a stored cross-site scripting vulnerability in the WP App Bar WordPress plugin (versions up to 1.5). The issue stems from improper neutralization of input in the 'app-bar-features' parameter and a missing authorization check in the App_Bar_Settings class constructor. This allows unauthenticated attackers to inject malicious scripts into multiple plugin settings. These scripts execute whenever an administrator accesses the plugin's settings page, potentially compromising admin accounts or site integrity. The vulnerability is rated high severity with a CVSS 3.1 score of 7.2 (Network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, partial confidentiality and integrity impact, no availability impact). No known exploits are reported in the wild, and no patch or remediation details are currently provided.

An unauthenticated attacker can inject and store malicious scripts in the plugin settings, which execute in the context of the admin settings page. This can lead to partial compromise of confidentiality and integrity of the affected WordPress site, such as theft of admin credentials or unauthorized actions performed with admin privileges. There is no reported impact on availability. The vulnerability affects all versions up to 1.5 of the WP App Bar plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the WordPress admin settings page to trusted users only and consider disabling or removing the WP App Bar plugin if it is not essential. Monitor vendor channels for updates or patches addressing this vulnerability.