Muffingroup

Betheme

24 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
7.1

CVE-2026-94415

  • EPSS 0.18%
  • Veröffentlicht 09.10.2026 10:00:32
  • Zuletzt bearbeitet 09.10.2026 13:20:48

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Muffingroup Betheme betheme allows Reflected XSS.This issue affects Betheme: from n/a through 28.5.8.

6.4

CVE-2026-6178

  • EPSS 0.35%
  • Veröffentlicht 26.08.2026 07:42:00
  • Zuletzt bearbeitet 26.08.2026 16:19:05

The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's 'icon_box_2' shortcode in all versions up to, and including, 28.4 due to insufficient input sanitization and output escaping on user supplied attributes. Thi...

9.9

CVE-2026-65548

  • EPSS 0.44%
  • Veröffentlicht 06.08.2026 14:27:34
  • Zuletzt bearbeitet 12.08.2026 20:58:37

Contributor Remote Code Execution (RCE) in Betheme <= 28.4.2 versions.

6.5

CVE-2026-6262

  • EPSS 0.35%
  • Veröffentlicht 05.05.2026 12:16:21
  • Zuletzt bearbeitet 05.05.2026 19:08:20

The Betheme theme for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 28.4. This is due to the upload_icons() function workflow using a user-controlled upload path (`mfn-icon-upload`) in a filesystem move operatio...

8.8

CVE-2026-6261

  • EPSS 0.61%
  • Veröffentlicht 05.05.2026 12:16:21
  • Zuletzt bearbeitet 05.05.2026 19:08:20

The Betheme theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 28.4. This is due to the upload_icons() function workflow moving and unzipping user-controlled ZIP files into a public uploads directory without ...

6.5

CVE-2025-63075

  • EPSS 0.19%
  • Veröffentlicht 09.12.2025 14:52:36
  • Zuletzt bearbeitet 07.10.2026 20:10:01

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in muffingroup Betheme betheme allows DOM-Based XSS.This issue affects Betheme: from n/a through <= 28.2.

6.4

CVE-2025-9371

  • EPSS 0.18%
  • Veröffentlicht 09.10.2025 11:20:56
  • Zuletzt bearbeitet 08.10.2026 13:10:00

The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘page_title’ parameter in all versions up to, and including, 28.1.6 due to insufficient input sanitization and output escaping of theme breadcrumbs. This makes it po...

6.4

CVE-2025-7399

  • EPSS 0.19%
  • Veröffentlicht 06.08.2025 03:41:00
  • Zuletzt bearbeitet 15.04.2026 00:35:42

The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via an Elementor display setting in all versions up to, and including, 28.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenti...

5.4

CVE-2025-3077

  • EPSS 0.27%
  • Veröffentlicht 16.04.2025 07:31:09
  • Zuletzt bearbeitet 04.06.2025 22:38:13

The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button shortcode and Custom CSS field in all versions up to, and including, 28.0.3 due to insufficient input sanitization and output escaping on user suppli...

5.4

CVE-2025-0450

  • EPSS 0.24%
  • Veröffentlicht 21.01.2025 11:15:10
  • Zuletzt bearbeitet 05.06.2025 14:26:26

The Betheme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom JS functionality in all versions up to, and including, 27.6.1 due to insufficient input sanitization and output escaping on user supplied attributes...