CVE-2020-37235

Name of the Vulnerable Software and Affected Versions Wibar versions prior to 1.1.9

Description The Brand component contains a stored cross-site scripting issue due to insufficient input sanitization and output escaping. Authenticated users with author, contributor, editor, or administrator privileges can inject malicious base64-encoded JavaScript payloads through the ftc brand url input field. These scripts execute automatically when other users visit the affected brand page.

Recommendations Update to a version newer than 1.1.8. Restrict access to the ftc brand url input field for users with lower-level privileges to minimize the risk of exploitation.