VulnSocial

CVE-2026-1074Disclosure

LOWCVSS 7.2 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The WP App Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'app-bar-features' parameter in all versions up to, and including, 1.5. This is due to insufficient input sanitization and output escaping combined with a missing authorization check in the `App_Bar_Settings` class constructor. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into multiple plugin settings that will execute whenever a user accesses the admin settings page.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 4 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 3 signals
  • Disclosure: 3 classified signals
  • General: 1 classified signal
  • Peaked 1d ago at 3 mentions (2026-03-07); latest day: 1
  • 4 total mentions across 2 days

Deep dive

Activity timeline4 mentions / 2d
01223Mentions · 2026-03-07: 3Mentions · 2026-03-12: 1Technical Details · 2026-03-07: 2Technical Details · 2026-03-12: 103-0703-12
Signal classification2 categories
Disclosure
375.0%
General
125.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-03-073
Disclosure2General1
2026-03-121
Disclosure1
Full discourse4 posts
  • CRAC Learning - Tech@cracbot
    Disclosure

    CVE-2026-1074 (CVSS:7.2, HIGH) is Awaiting Analysis. The WP App Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'app-bar-features' parameter in..https://nvd.nist.gov/vuln/detail/CVE-2026-1074 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre

    Post summary

    CVE‑2026‑1074, a high‑severity stored XSS in the WP App Bar plugin, is publicly disclosed with CVSS 7.2 and is currently awaiting analysis.

    0000018
    172 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-1074 The WP App Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'app-bar-features' parameter in all versions up to, and including, 1.5. This is… https://www.cve.org/CVERecord?id=CVE-2026-1074

    Post summary

    The notice discloses a stored XSS vulnerability in the WP App Bar plugin (v≤1.5) through the 'app-bar-features' parameter, without mentioning any PoC, exploit, patch, or active exploitation.

    00000130
    56.6K followersView on X
  • RedPacket Security@RedPacketSec
    General

    CVE Alert: CVE-2026-1074 - ryscript - WP App Bar - https://www.redpacketsecurity.com/cve-alert-cve-2026-1074-ryscript-wp-app-bar/ #OSINT #ThreatIntel #CyberSecurity #cve-2026-1074 #ryscript #wp-app-bar

    Post summary

    A CVE alert for CVE‑2026‑1074 affecting ryscript WP App Bar has been posted, but it includes only the identifier, product name, and a link, with no further technical details, PoC, or patch information.

    0000088
    3.5K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-1074 Stored XSS in WordPress WP App Bar Plugin via Unauthenticated Injection https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-1074

    Post summary

    The post announces a stored XSS vulnerability (CVE‑2026‑1074) affecting the WordPress WP App Bar Plugin, but shows no evidence of exploitation or mitigations.

    0000036
    4.0K followersView on X

Explore more

Back to dashboard