Contextual Adminbar Color
Contextual Adminbar Color has one disclosed vulnerability in the WordSec catalog, all reported in 2020; it is fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Contextual Adminbar Color has a vendor fix available, so running the current release closes it.
All of these findings were reported by Julio Potier. Contextual Adminbar Color is installed on roughly 500 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
Contextual Adminbar Color <= 0.2 - Stored Cross-Site Scripting
Read the full analysisVulnerability Records

Contextual Adminbar Color
Author
Jb Audras
This plugins provides custom admin bar colors to differentiate environments (staging, preprod, production). It’s really easy to use and developer-friendly. The plugin provides a settings screen which several options: choose between several color predefined schemes. use a favicon to better differentiate your environments in your browser’s tabs. add a custom message in your admin bar, like “Production website”, “staging version” or whatever your want. choose the user roles that will see the color scheme (other roles will see the default admin bar). It also offers few PHP constants you can use in your wp-config.php file (see Frequently Asked Questions below). Since WordPress Core will probably deprecate alternate admin color schemes in mid-term, this plugin is meant to be use by those who rely on colors to know is they are in staging, preproduction or production environment. Last but not least, all provided color schemes are accessibility-ready!
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C