Themes Vulnerabilities
Wibar < 1.2.1 - Authenticated Stored Cross-Site Scripting
Description
The theme contains a Brands feature which is vulnerable to stored Cross Site Scripting (XSS) within the logo URL parameter.
Edit (WPScanTeam)
November 27th, 2020 - Vendor Contacted via https://themeftc.ticksy.com/submit/
November 28th-29th, 2020 - Exchanges with vendor's support but they do not understand the issue.
November 30th, 2020 - Escalated to Envato and disclosure
December 3rd, 2020 - v1.2.1 released, apparently fixing the issue (but we were not able to confirm)
Affects Themes
Fixed in 1.2.1 References
Classification
Type
XSS
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Ilca Lucian Florin
Verified
No
WPVDB ID
Timeline
Publicly Published
2020-11-30 (about 5 years ago)
Added
2020-11-30 (about 5 years ago)
Last Updated
2020-12-03 (about 5 years ago)
WPScan 