Vulnerability · Published May 16, 2026 · Assigned by VulnCheck

CVE-2020-37235WordPress Theme Wibar 1.1.8 Stored Cross-Site Scripting via Brand Component

Medium 6.4

In plain English

A medium-severity cross-site scripting in Theme Wibar from themeftc. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 3.1)6.4Medium

Exploit odds (30 days)0.2%top 84.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

WordPress Theme Wibar 1.1.8 contains a stored cross-site scripting vulnerability in the Brand component that allows authenticated users to inject malicious scripts by manipulating the Logo URL parameter. Attackers with editor, administrator, contributor, or author privileges can inject base64-encoded script payloads through the ftc_brand_url input field to execute arbitrary JavaScript when users visit the brand page.

Affected products (as reported)

Vendor	Product	Versions
themeftc	Theme Wibar	1.1.8

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

References

ExploitDB-49107 exploit
Official Product Homepage product
Product Reference product
VulnCheck Advisory: WordPress Theme Wibar 1.1.8 Stored Cross-Site Scripting via Brand Component third-party-advisory