Betheme Vulnerabilities

The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's 'icon_box_2' shortcode in all versions up to, and including, 28.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-leve...

CVSS:

6.4

Affected:

up to 28.4

Fixed in:

28.4.1

Disclosed:

Aug 25, 2026

CVE-2026-6178 on NVD →

The Betheme theme for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 28.5.7. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.

CVSS:

8.8

Affected:

up to 28.5.7

Fixed in:

28.5.8

Disclosed:

Jul 28, 2026

CVE-2026-65548 on NVD →

The Betheme theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 28.4. This is due to the upload_icons() function workflow moving and unzipping user-controlled ZIP files into a public uploads directory without validating extracted file types. This makes it possible for authentica...

CVSS:

8.8

Affected:

up to 28.4

Fixed in:

28.4.1

Disclosed:

May 4, 2026

CVE-2026-6261 on NVD →

The Betheme theme for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 28.4. This is due to the upload_icons() function workflow using a user-controlled upload path (`mfn-icon-upload`) in a filesystem move operation without constraining it to the uploads directory. This makes it poss...

CVSS:

6.5

Affected:

up to 28.4

Fixed in:

28.4.1

Disclosed:

May 4, 2026

CVE-2026-6262 on NVD →

The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘page_title’ parameter in all versions up to, and including, 28.1.6 due to insufficient input sanitization and output escaping of theme breadcrumbs. This makes it possible for authenticated attackers, with Contributor-level access and...

CVSS:

6.4

Affected:

up to 28.1.6

Fixed in:

28.1.7

Disclosed:

Oct 8, 2025

CVE-2025-9371 on NVD →

The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 28.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will...

CVSS:

6.4

Affected:

up to 28.2

Fixed in:

28.2.1

Disclosed:

Oct 6, 2025

CVE-2025-63075 on NVD →

The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via an Elementor display setting in all versions up to, and including, 28.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject ar...

CVSS:

6.4

Affected:

up to 28.1.3

Fixed in:

28.1.4

Disclosed:

Aug 5, 2025

CVE-2025-7399 on NVD →

Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Magnific Popups library (version 1.1.0) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-l...

CVSS:

6.4

Affected:

up to 28.4

Fixed in:

28.4.1

Disclosed:

Jul 2, 2025

CVE-2024-5647 on NVD →

The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button shortcode and Custom CSS field in all versions up to, and including, 28.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, wit...

CVSS:

6.4

Affected:

up to 28.0.3

Fixed in:

28.0.4

Disclosed:

Apr 15, 2025

CVE-2025-3077 on NVD →

The Betheme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom JS functionality in all versions up to, and including, 27.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor...

CVSS:

6.4

Affected:

up to 27.6.1

Fixed in:

27.6.2

Disclosed:

Jan 20, 2025

CVE-2025-0450 on NVD →

The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 27.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web...

CVSS:

6.4

Affected:

up to 27.5.5

Fixed in:

27.5.6

Disclosed:

Sep 12, 2024

CVE-2024-5567 on NVD →

The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's shortcodes in all versions up to, and including, 27.5.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-le...

CVSS:

6.4

Affected:

up to 27.5.6

Fix:

No patched version reported

Disclosed:

Aug 29, 2024

CVE-2024-3998 on NVD →

The Betheme theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 27.5.6 via deserialization of untrusted input of the 'mfn-page-items' post meta value. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known...

CVSS:

8.8

Affected:

up to 27.5.6

Fixed in:

27.5.7

Disclosed:

Aug 29, 2024

CVE-2024-2694 on NVD →

The Betheme theme for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on one of its functions in versions up to, and including, 27.1.1. This makes it possible for authenticated attackers, with contributor-level access and above, to invoke this function.

CVSS:

6.3

Affected:

up to 27.1.1

Fixed in:

27.1.2

Disclosed:

Nov 14, 2023

CVE-2023-47770 on NVD →

The Betheme theme for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the '_tool_history_delete' AJAX function in versions up to, and including, 27.1.1. This makes it possible for authenticated attackers, with author-level access and above, to delete site design revisions and b...

CVSS:

6.5

Affected:

up to 27.1.1

Fixed in:

27.1.2

Disclosed:

Aug 10, 2023

CVE-2023-39998 on NVD →

The Betheme theme for WordPress is vulnerable to Reflected Cross-Site Scripting on shop pages in versions up to, and including, 26.7.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can succes...

CVSS:

6.1

Affected:

up to 26.7.5

Fixed in:

26.8

Disclosed:

Apr 13, 2023

CVE-2023-29101 on NVD →

The Betheme theme for WordPress is vulnerable to authorization bypass in versions up to, and including, 26.6.2. This is due to a missing capability check on the mfnvb_init_vb() function that initializes the visual editor for the plugin and discloses the plugin's page builder nonces and functionality to an attacker. Thi...

CVSS:

8.8

Affected:

up to 26.6.1

Fixed in:

26.6.3

Disclosed:

Nov 21, 2022

CVE-2022-45356 on NVD →

The Betheme theme for WordPress is vulnerable to authorization bypass that leads to stored Cross-Site Scripting in versions up to, and including, 26.6.2. This is due to a missing capability check on the mfnvb_init_vb() function that initializes the visual editor for the plugin and discloses the plugin's page builder no...

CVSS:

6.4

Affected:

up to 26.6.2

Fixed in:

26.6.3

Disclosed:

Nov 21, 2022

CVE-2022-45363 on NVD →

The Betheme theme for WordPress is vulnerable to authorization bypass in versions up to, and including, 26.6.2. This is due to a missing capability check on the mfnvb_init_vb() function that initializes the visual editor for the plugin and discloses the plugin's page builder nonces and functionality to an attacker. Thi...

CVSS:

4.3

Affected:

up to 26.6.2

Fixed in:

26.6.3

Disclosed:

Nov 21, 2022

CVE-2022-45353 on NVD →

The Betheme theme for WordPress is vulnerable to authorization bypass in versions up to, and including, 26.6.2. This is due to a missing capability check on the mfnvb_init_vb() function that initializes the visual editor for the plugin and discloses the plugin's page builder nonces and functionality to an attacker. Thi...

CVSS:

4.3

Affected:

up to 26.6.2

Fixed in:

26.6.3

Disclosed:

Nov 21, 2022

CVE-2022-45351 on NVD →

The Betheme theme for WordPress is vulnerable to authorization bypass in versions up to, and including, 26.6.2. This is due to a missing capability check on the mfnvb_init_vb() function that initializes the visual editor for the plugin and discloses the plugin's page builder nonces and functionality to an attacker. Thi...

CVSS:

4.3

Affected:

up to 26.6.2

Fixed in:

26.6.3

Disclosed:

Nov 21, 2022

CVE-2022-45349 on NVD →

The Betheme theme for WordPress is vulnerable to authorization bypass in versions up to, and including, 26.6.2. This is due to a missing capability check on the mfnvb_init_vb() function that initializes the visual editor for the plugin and discloses the plugin's page builder nonces and functionality to an attacker. Thi...

CVSS:

4.3

Affected:

up to 26.6.2

Fixed in:

26.6.3

Disclosed:

Nov 21, 2022

CVE-2022-45352 on NVD →

The Betheme theme for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 26.5.1.4 via deserialization of untrusted input supplied via the import, mfn-items-import-page, and mfn-items-import parameters passed through the mfn_builder_import, mfn_builder_import_page, importdata, importsingle...

CVSS:

8.8

Affected:

up to 26.5.1.4

Fixed in:

26.6

Disclosed:

Nov 18, 2022

CVE-2022-3861 on NVD →

The Betheme theme for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 26.5.1.4 via deserialization of untrusted input from an unknown parameter. This allows subscriber-level attackers to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the t...

CVSS:

8.8

Affected:

up to 26.5.1.4

Fixed in:

26.6

Disclosed:

Nov 17, 2022

CVE-2022-45077 on NVD →