CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
What the vulnerability does
WordPress Theme Wibar 1.1.8 contains a stored cross-site scripting vulnerability in the Brand component that allows authenticated users to inject malicious scripts by manipulating the Logo URL parameter. Attackers with editor, administrator, contributor, or author privileges can inject base64-encoded script payloads through the ftc_brand_url input field to execute arbitrary JavaScript when users visit the brand page.
Explanation of Vulnerability in Simple Terms
Theme Wibar contains a cross-site scripting (XSS) vulnerability that allows an attacker to inject malicious scripts into the site. A logged-in user must visit a specially crafted page for the attack to work. The injected script executes in the victim's browser and can modify page content or steal session data.
What an attacker can do
Inject malicious scripts that execute in a victim's browser and modify page content or steal data.
Potential impact on your site
Logged-in users visiting attacker-controlled links may have their sessions compromised or see altered page content.
Conditions required to exploit
Attacker needs a low-privilege account and the victim must visit a malicious link or page.
Key dates
External resources
Related vulnerabilities
