Muffingroup

Betheme

21 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.5

CVE-2026-6262

  • EPSS 0.35%
  • Veröffentlicht 05.05.2026 12:16:21
  • Zuletzt bearbeitet 05.05.2026 19:08:20

The Betheme theme for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 28.4. This is due to the upload_icons() function workflow using a user-controlled upload path (`mfn-icon-upload`) in a filesystem move operatio...

8.8

CVE-2026-6261

  • EPSS 0.61%
  • Veröffentlicht 05.05.2026 12:16:21
  • Zuletzt bearbeitet 05.05.2026 19:08:20

The Betheme theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 28.4. This is due to the upload_icons() function workflow moving and unzipping user-controlled ZIP files into a public uploads directory without ...

6.5

CVE-2025-63075

  • EPSS 0.16%
  • Veröffentlicht 09.12.2025 14:52:36
  • Zuletzt bearbeitet 15.04.2026 00:35:42

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in muffingroup Betheme betheme allows DOM-Based XSS.This issue affects Betheme: from n/a through <= 28.2.

6.4

CVE-2025-9371

  • EPSS 0.18%
  • Veröffentlicht 09.10.2025 11:20:56
  • Zuletzt bearbeitet 15.04.2026 00:35:42

The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘page_title’ parameter in all versions up to, and including, 28.1.6 due to insufficient input sanitization and output escaping of theme breadcrumbs. This makes it po...

6.4

CVE-2025-7399

  • EPSS 0.18%
  • Veröffentlicht 06.08.2025 03:41:00
  • Zuletzt bearbeitet 15.04.2026 00:35:42

The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via an Elementor display setting in all versions up to, and including, 28.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenti...

5.4

CVE-2025-3077

  • EPSS 0.23%
  • Veröffentlicht 16.04.2025 07:31:09
  • Zuletzt bearbeitet 04.06.2025 22:38:13

The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button shortcode and Custom CSS field in all versions up to, and including, 28.0.3 due to insufficient input sanitization and output escaping on user suppli...

5.4

CVE-2025-0450

  • EPSS 0.23%
  • Veröffentlicht 21.01.2025 11:15:10
  • Zuletzt bearbeitet 05.06.2025 14:26:26

The Betheme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom JS functionality in all versions up to, and including, 27.6.1 due to insufficient input sanitization and output escaping on user supplied attributes...

5.4

CVE-2024-5567

  • EPSS 0.3%
  • Veröffentlicht 13.09.2024 07:15:06
  • Zuletzt bearbeitet 26.09.2024 18:27:51

The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 27.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attack...

5.4

CVE-2024-3998

  • EPSS 0.25%
  • Veröffentlicht 30.08.2024 05:15:12
  • Zuletzt bearbeitet 03.09.2024 15:00:36

The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's shortcodes in all versions up to, and including, 27.5.6 due to insufficient input sanitization and output escaping on user supplied attributes. T...

8.8

CVE-2024-2694

  • EPSS 0.62%
  • Veröffentlicht 30.08.2024 05:15:12
  • Zuletzt bearbeitet 03.09.2024 15:10:54

The Betheme theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 27.5.6 via deserialization of untrusted input of the 'mfn-page-items' post meta value. This makes it possible for authenticated attackers, wit...