What is the CVSS score of CVE-2026-1074?

CVE-2026-1074 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-1074?

WordPress websites using the WP App Bar plugin (versions up to 1.5) are vulnerable to stored cross-site scripting attacks that could allow attackers to inject malicious code visible to all site…

How to fix or mitigate CVE-2026-1074?

Within 24 hours: Audit all WordPress installations to identify WP App Bar plugin usage and versions; immediately disable the plugin if not business-critical. Within 7 days: Contact the plugin vendor for patch availability and timeline; implement Web Application Firewall rules to block malicious 'app-bar-features' parameter inputs. Within 30 days: Either apply the vendor patch once available, migrate to an alternative plugin, or maintain compensating controls with continuous monitoring.

WordPress CVE-2026-1074

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-07 security@wordfence.com

WordPress XSS

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 07, 2026 - 08:16 nvd

HIGH 7.2

DescriptionCVE.org

The WP App Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'app-bar-features' parameter in all versions up to, and including, 1.5. This is due to insufficient input sanitization and output escaping combined with a missing authorization check in the App_Bar_Settings class constructor. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into multiple plugin settings that will execute whenever a user accesses the admin settings page.

AnalysisAI

Unauthenticated attackers can inject malicious scripts into WordPress sites running the WP App Bar plugin (versions up to 1.5) through the 'app-bar-features' parameter due to missing input validation and authorization checks. When site administrators access the plugin's settings page, the stored payload executes in their browser, enabling credential theft or unauthorized actions. No patch is currently available for this vulnerability.

Technical ContextAI

Classified as CWE-79 (Cross-site Scripting (XSS)). Affects WP App Bar (WordPress plugin). The WP App Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'app-bar-features' parameter in all versions up to, and including, 1.5. This is due to insufficient input sanitization and output escaping combined with a missing authorization check in the App_Bar_Settings class constructor. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into multiple plugin settings that will execute whenever a user accesses the admin settings page.

Affected ProductsAI

Vendor: WordPress. Product: WP App Bar (WordPress plugin).

RemediationAI

Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.