Medium severity6.4NVD Advisory· Published May 16, 2026· Updated May 18, 2026

CVE-2020-37235

Description

WordPress Theme Wibar 1.1.8 contains a stored cross-site scripting vulnerability in the Brand component that allows authenticated users to inject malicious scripts by manipulating the Logo URL parameter. Attackers with editor, administrator, contributor, or author privileges can inject base64-encoded script payloads through the ftc_brand_url input field to execute arbitrary JavaScript when users visit the brand page.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

themeftc/Wibarllm-create
Range: =1.1.8
WordPress/Wibarwp-canonicalize

Patches

Vulnerability mechanics

References

demo.themeftc.com/wibarnvd
themeforest.net/item/wibar-responsive-woocommerce-wordpress-theme/20994798nvd
www.exploit-db.com/exploits/49107nvd
www.vulncheck.com/advisories/wordpress-theme-wibar-stored-cross-site-scripting-via-brand-componentnvd

News mentions

No linked articles in our index yet.

cvss	0.416
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000