Advisories · Technology
Muffingroup Betheme.
Every CVE that names Muffingroup Betheme among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.1 High
WordPress Betheme theme <= 28.5.8 - Cross Site Scripting (XSS) vulnerability
- Muffingroup Betheme
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Betheme <= 28.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_box_2' Shortcode
- MuffinGroup Betheme
- Cross-site scripting (XSS)
- CVSS 9.9 CriticalCritical · CVSS 9+
WordPress Betheme theme <= 28.4.2 - Remote Code Execution (RCE) vulnerability
- Muffingroup Betheme
- Code injection
- CVSS 8.8 High
Betheme <= 28.4 - Authenticated (Author+) Arbitrary File Upload to Remote Code Execution via Icon Pack Upload
- MuffinGroup Betheme
- Unrestricted file upload
- CVSS 6.5 Medium
Betheme <= 28.4 - Authenticated (Contributor+) Arbitrary File Deletion via 'mfn-icon-upload'
- MuffinGroup Betheme
- Path traversal
- CVSS 6.5 Medium
WordPress Betheme theme <= 28.2 - Cross Site Scripting (XSS) vulnerability
- muffingroup Betheme
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Betheme <= 28.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'page_title'
- MuffinGroup Betheme
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Betheme <= 28.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- MuffinGroup Betheme
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library
- BlossomThemes Social Feed
- sayful Carousel Slider
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Betheme <= 28.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- MuffinGroup Betheme
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Betheme <= 27.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS
- MuffinGroup Betheme
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Betheme | Responsive Multipurpose WordPress & WooCommerce Theme <= 27.5.5 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File
- MuffinGroup Betheme
- Cross-site scripting (XSS)
- CVSS 8.8 High
Betheme <= 27.5.6 - Authenticated (Contributor+) PHP Object Injection
- MuffinGroup Betheme
- Insecure deserialization
- CVSS 6.4 Medium
Betheme | Responsive Multipurpose WordPress & WooCommerce Theme <= 27.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- MuffinGroup Betheme
- Cross-site scripting (XSS)
- CVSS 8.2 High
WordPress BeTheme theme <= 27.1.1 - Author+ Broken Access Control vulnerability
- Muffingroup Betheme
- Broken access control
- CVSS 5.4 Medium
WordPress Betheme premium theme <= 26.6.1 - Broken Access Control vulnerability
- Muffingroup Betheme
- Broken access control
- CVSS 5.4 Medium
WordPress Betheme premium theme <= 26.6.1 - Broken Access Control vulnerability
- Muffingroup Betheme
- Broken access control
- CVSS 5.4 Medium
WordPress Betheme premium theme <= 26.6.1 - Broken Access Control vulnerability
- Muffingroup Betheme
- Broken access control
- CVSS 4.3 Medium
WordPress Betheme premium theme <= 26.6.1 - Broken Access Control vulnerability
- Muffingroup Betheme
- Broken access control
- CVSS 7.1 High
WordPress Betheme Theme <= 26.7.5 is vulnerable to Cross Site Scripting (XSS)
- Muffingroup Betheme
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
WordPress Betheme theme <= 26.6.1 is vulnerable to Broken Access Control
- Muffingroup Betheme
- Broken access control
- CVSS 5.4 Medium
WordPress Betheme premium theme <= 26.6.1 - Auth. Stored Cross-Site Scripting (XSS) vulnerability
- Muffingroup Betheme
- Cross-site scripting (XSS)
- CVSS 8.8 High
Betheme <= 26.5.1.4 - Authenticated (Subscriber+) PHP Object Injection
- MuffinGroup Betheme
- Insecure deserialization