PT-2026-41435 · Themeftc · Theme Wibar

Publicado 2026-05-16 · Atualizado 2026-05-16 · CVE-2020-37235

Mitre

CVSS v3.1

6.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

WordPress Theme Wibar 1.1.8 contains a stored cross-site scripting vulnerability in the Brand component that allows authenticated users to inject malicious scripts by manipulating the Logo URL parameter. Attackers with editor, administrator, contributor, or author privileges can inject base64-encoded script payloads through the ftc brand url input field to execute arbitrary JavaScript when users visit the brand page.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2020-37235

Produtos afetados

Theme Wibar

Referências · 5

• 🔥 https://exploit-db.com/exploits/49107 · Exploit
• https://themeforest.net/item/wibar-responsive-woocommerce-wordpress-theme/20994798 · Nota
• http://demo.themeftc.com/wibar · Nota
• https://vulncheck.com/advisories/wordpress-theme-wibar-stored-cross-site-scripting-via-brand-component · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2020-37235 · Nota de Segurança