CVE-2020-37235

MediumCVSS 6.4/10Last modified Sep 29, 2026

Description

WordPress Theme Wibar 1.1.8 contains a stored cross-site scripting vulnerability in the Brand component that allows authenticated users to inject malicious scripts by manipulating the Logo URL parameter. Attackers with editor, administrator, contributor, or author privileges can inject base64-encoded script payloads through the ftc_brand_url input field to execute arbitrary JavaScript when users visit the brand page.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
May 16, 2026
Last modified
Sep 29, 2026
NVD status
Deferred

Related CVEs from 2020

CVE-2020-372366.4NewsLister contains an authenticated persistent cross-site scripting vulnerability that allows authenticated administrators to inject maliciCVE-2020-372376.4Composr CMS 10.0.34 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious scCVE-2020-372386.4CMS Made Simple 2.2.15 contains a stored cross-site scripting vulnerability that allows authenticated users with Content Manager access to iCVE-2020-372399.8libbabl 0.1.62 contains a broken double free detection vulnerability that allows attackers to bypass memory safety checks by exploiting signCVE-2020-37248.8Adobe Framemaker versions 2019.0.4 and below have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary codeCVE-2020-372406.4Queue Management System 4.0.0 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject maliciCVE-2020-372415.3bloofoxCMS 0.5.2.1 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions by tricking lCVE-2020-372428.2Supsystic Ultimate Maps 1.1.12 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL querieCVE-2020-372438.2Supsystic Pricing Table 1.8.7 contains an SQL injection vulnerability in the 'sidx' GET parameter that allows unauthenticated attackers to eCVE-2020-372448.2Supsystic Membership 1.4.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries byCVE-2020-372457.5Supsystic Digital Publications 1.6.9 contains a path traversal vulnerability in the Folder input field that allows attackers to access filesCVE-2020-372466.2Supsystic Backup 2.3.9 contains a local file inclusion vulnerability that allows unauthenticated attackers to read and delete arbitrary file
CVE-2020-37235: Medium severity, CVSS 6.4 | Vulnix