CVE-2020-37235

MEDIUM 5.1 CVSS 4.0

Published: May 16, 2026
Last modified: September 29, 2026
NVD status: Deferred
Reported by: disclosure@vulncheck.com
Weakness: CWE-79
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Description

WordPress Theme Wibar 1.1.8 contains a stored cross-site scripting vulnerability in the Brand component that allows authenticated users to inject malicious scripts by manipulating the Logo URL parameter. Attackers with editor, administrator, contributor, or author privileges can inject base64-encoded script payloads through the ftc_brand_url input field to execute arbitrary JavaScript when users visit the brand page.

Affected products and versions

themeftc Theme Wibar — Version 1.1.8

References

demo.themeftc.com http://demo.themeftc.com/wibar
themeforest.net https://themeforest.net/item/wibar-responsive-woocommerce-wordpress-theme/20994798
www.exploit-db.com https://www.exploit-db.com/exploits/49107
www.vulncheck.com https://www.vulncheck.com/advisories/wordpress-theme-wibar-stored-cross-site-scripting-via-brand-component
nvd.nist.gov Official NVD record

WordPress CVEs

Description

Affected products and versions

References