MuffinGroup

Records26All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high11CVSS 7.0–8.9

Exploited now

MuffinGroup records in CISA KEV

No MuffinGroup vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Betheme 16 records MEDIUM Becustom 1 record MEDIUM

Records

26 records

TI-2026-46718 CVE-2026-65548 · GHSA-4qq3-3jrp-49qg

WordPress Betheme theme <= 28.4.2 - Remote Code Execution (RCE) vulnerability

MEDIUM 44

Contributor Remote Code Execution (RCE) in Betheme <= 28.4.2 versions.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00789 Published 2026-08-06 No fix listed CWE-94

TI-2022-03539 CVE-2022-3861 · GHSA-qmhr-xwh2-cg99

Betheme <= 26.5.1.4 - Authenticated (Subscriber+) PHP Object Injection

MEDIUM 44

The Betheme theme for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 26.5.1.4 via deserialization of untrusted input supplied via the import, mfn-items-import-page, and mfn-items-import…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02218 Published 2022-11-21 No fix listed CWE-502

TI-2022-03442 CVE-2022-3747 · GHSA-f2m2-mj72-fj87

Becustom <= 1.0.5.2 - Cross-Site Request Forgery

MEDIUM 42

The Becustom plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.5.2.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0088 Published 2022-11-29 No fix listed CWE-352

TI-2026-05490 CVE-2026-6261 · GHSA-xjrr-vq8h-v4xh

Betheme <= 28.4 - Authenticated (Author+) Arbitrary File Upload to Remote Code Execution via Icon Pack Upload

MEDIUM 41

The Betheme theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 28.4.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00612 Published 2026-05-05 No fix listed CWE-434

TI-2024-02509 CVE-2024-2694 · GHSA-76j5-j37r-gjv3

Betheme <= 27.5.6 - Authenticated (Contributor+) PHP Object Injection

MEDIUM 41

The Betheme theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 27.5.6 via deserialization of untrusted input of the 'mfn-page-items' post meta value.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00623 Published 2024-08-30 No fix listed CWE-502

TI-2022-22322 CVE-2022-45356 · GHSA-589j-x7qv-7xxp

WordPress Betheme premium theme <= 26.6.1 - Broken Access Control vulnerability

LOW 39

Missing Authorization vulnerability in Muffingroup Betheme.This issue affects Betheme: from n/a through 26.6.1.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00536 Published 2024-03-25 No fix listed CWE-862

TI-2022-22167 CVE-2022-45077 · GHSA-pwpx-r9xc-fhg4

WordPress Betheme theme <= 26.5.1.4 - Auth. PHP Object Injection vulnerability

LOW 39

Auth. (subscriber+) PHP Object Injection vulnerability in Betheme theme <= 26.5.1.4 on WordPress.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00684 Published 2022-11-17 No fix listed CWE-502

TI-2023-20890 CVE-2023-39998 · GHSA-7gqm-c625-582w

WordPress BeTheme theme <= 27.1.1 - Author+ Broken Access Control vulnerability

LOW 36

Missing Authorization vulnerability in Muffingroup Betheme.This issue affects Betheme: from n/a through 27.1.1.

CVSS 3.1HIGH 8.2 Network High privileges No interaction EPSS 0.00457 Published 2024-06-19 No fix listed CWE-862

TI-2022-22319 CVE-2022-45353 · GHSA-hp3q-747r-8rpp

WordPress Betheme theme <= 26.6.1 is vulnerable to Broken Access Control

LOW 36

Broken Access Control in Betheme theme <= 26.6.1 on WordPress.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.0051 Published 2023-01-14 No fix listed CWE-863

TI-2023-25880 CVE-2023-47770 · GHSA-vhfx-77qc-h5hr

WordPress BeTheme theme <= 27.1.1 - Contributor+ Broken Access Control vulnerability

LOW 33

Missing Authorization vulnerability in Muffin Group Betheme.This issue affects Betheme: from n/a through 27.1.1.

CVSS 3.1HIGH 7.6 Network Low privileges No interaction EPSS 0.00289 Published 2024-06-19 No fix listed CWE-862

TI-2023-13543 CVE-2023-29101 · GHSA-hf3g-33gp-h76v

WordPress Betheme Theme <= 26.7.5 is vulnerable to Cross Site Scripting (XSS)

LOW 31

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Muffingroup Betheme theme <= 26.7.5 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00382 Published 2023-05-10 No fix listed CWE-79

TI-2026-69921 CVE-2026-94415 · GHSA-whpr-x8x8-4fvp

Reflected cross-site scripting in Muffingroup Betheme theme

LOW 30

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Muffingroup Betheme betheme allows Reflected XSS.This issue affects Betheme: from n/a through 28.5.8.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00175 Published 2026-10-09 No fix listed CWE-79

TI-2026-05491 CVE-2026-6262 · GHSA-83jf-j247-fwjw

Betheme <= 28.4 - Authenticated (Contributor+) Arbitrary File Deletion via 'mfn-icon-upload'

LOW 29

The Betheme theme for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 28.4.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00349 Published 2026-05-05 No fix listed CWE-22

TI-2024-05243 CVE-2024-5647 · GHSA-3439-fg7p-gc46

Cross-site scripting in BlossomThemes Social Feed

LOW 29

Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Magnific Popups library (version 1.1.0) in various versions due to insufficient input sanitization and output escaping…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00366 Published 2025-07-03 No fix listed CWE-79

TI-2026-05420 CVE-2026-6178 · GHSA-hxjw-xf28-w726

Betheme <= 28.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_box_2' Shortcode

LOW 28

The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's 'icon_box_2' shortcode in all versions up to, and including, 28.4 due to insufficient input sanitization and output escaping on…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00357 Published 2026-08-26 No fix listed CWE-79

TI-2025-39223 CVE-2025-63075 · GHSA-6v28-vr6p-rcfw

WordPress Betheme theme <= 28.2 - Cross Site Scripting (XSS) vulnerability

LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in muffingroup Betheme betheme allows DOM-Based XSS.This issue affects Betheme: from n/a through <= 28.2.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00196 Published 2025-12-09 No fix listed CWE-79

TI-2025-08584 CVE-2025-9371 · GHSA-p5vm-vjvh-m7v5

Betheme <= 28.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'page_title'

LOW 28

The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘page_title’ parameter in all versions up to, and including, 28.1.6 due to insufficient input sanitization and output escaping of theme…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00197 Published 2025-10-09 No fix listed CWE-79

TI-2025-06740 CVE-2025-7399 · GHSA-9r2x-j4cw-x2vv

Betheme <= 28.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

LOW 28

The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via an Elementor display setting in all versions up to, and including, 28.1.3 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00225 Published 2025-08-06 No fix listed CWE-79

TI-2025-02689 CVE-2025-3077 · GHSA-6476-gj69-54v6

Betheme <= 28.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

LOW 28

The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button shortcode and Custom CSS field in all versions up to, and including, 28.0.3 due to insufficient input sanitization and…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00285 Published 2025-04-16 No fix listed CWE-79

TI-2025-00367 CVE-2025-0450 · GHSA-hq4j-7m45-9jhp

Betheme <= 27.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS

LOW 28

The Betheme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom JS functionality in all versions up to, and including, 27.6.1 due to insufficient input sanitization and output escapi…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00247 Published 2025-01-21 No fix listed CWE-79

TI-2024-05173 CVE-2024-5567 · GHSA-7q39-g4rg-578j

Cross-site scripting in MuffinGroup Betheme

LOW 28

The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 27.5.5 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00322 Published 2024-09-13 No fix listed CWE-79

TI-2024-03730 CVE-2024-3998 · GHSA-px2r-hc96-6x9w

Cross-site scripting in MuffinGroup Betheme

LOW 28

The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's shortcodes in all versions up to, and including, 27.5.6 due to insufficient input sanitization and output escaping…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00263 Published 2024-08-30 No fix listed CWE-79

TI-2022-22329 CVE-2022-45363 · GHSA-cxvg-72p4-7x8f

WordPress Betheme premium theme <= 26.6.1 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

LOW 25

Auth. (subscriber+) Stored Cross-Site Scripting (XSS) in Muffingroup Betheme theme <= 26.6.1 on WordPress.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00424 Published 2022-11-22 No fix listed CWE-79

TI-2022-22318 CVE-2022-45352 · GHSA-wcqr-c98g-grwq

WordPress Betheme premium theme <= 26.6.1 - Broken Access Control vulnerability

LOW 25

Missing Authorization vulnerability in Muffingroup Betheme.This issue affects Betheme: from n/a through 26.6.1.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00405 Published 2024-03-25 No fix listed CWE-862

TI-2022-22317 CVE-2022-45351 · GHSA-387v-g9vc-rrrf

WordPress Betheme premium theme <= 26.6.1 - Broken Access Control vulnerability

LOW 25

Missing Authorization vulnerability in Muffingroup Betheme.This issue affects Betheme: from n/a through 26.6.1.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00465 Published 2024-03-25 No fix listed CWE-862

Open these records in search →