CVE-2020-37235: WordPress Theme Wibar 1.1.8 Stored Cross-Site Scripting via Brand Component

Severity: medium (CVSS 6.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-16 · updated 2026-09-29
Weakness: CWE-79

Description

WordPress Theme Wibar 1.1.8 contains a stored cross-site scripting vulnerability in the Brand component that allows authenticated users to inject malicious scripts by manipulating the Logo URL parameter. Attackers with editor, administrator, contributor, or author privileges can inject base64-encoded script payloads through the ftc_brand_url input field to execute arbitrary JavaScript when users visit the brand page.

Affected products

themeftc Theme Wibar: 1.1.8

References

http://demo.themeftc.com/wibar
https://themeforest.net/item/wibar-responsive-woocommerce-wordpress-theme/20994798
https://www.exploit-db.com/exploits/49107
https://www.vulncheck.com/advisories/wordpress-theme-wibar-stored-cross-site-scripting-via-brand-component

Get alerted when CVE-2020-37235 or the next vulnerability affects your stack