CVE-2020-37235

5.1 mediumEPSS 0.2%

Medium (5.1). EPSS 0.2% chance of exploitation in the next 30 days.

WordPress Theme Wibar 1.1.8 contains a stored cross-site scripting vulnerability in the Brand component that allows authenticated users to inject malicious scripts by manipulating the Logo URL parameter. Attackers with editor, administrator, contributor, or author privileges can inject base64-encoded script payloads through the ftc_brand_url input field to execute arbitrary JavaScript when users visit the brand page.

Severity

CVSS 4.0

5.1 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

CVSS 3.1

6.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 15% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2026-05-16
Modified: 2026-09-29
Record from: the NVD, synced 2026-10-19

References

http://demo.themeftc.com/wibar
https://themeforest.net/item/wibar-responsive-woocommerce-wordpress-theme/20994798
https://www.exploit-db.com/exploits/49107
https://www.vulncheck.com/advisories/wordpress-theme-wibar-stored-cross-site-scripting-via-brand-component

Check your stack JSON