MuffinGroup

Records26All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high11CVSS 7.0–8.9

Exploited now

MuffinGroup records in CISA KEV

No MuffinGroup vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Betheme 16 records MEDIUM Becustom 1 record MEDIUM

Records

16 records in Betheme · all components

TI-2022-03539 CVE-2022-3861 · GHSA-qmhr-xwh2-cg99

Betheme <= 26.5.1.4 - Authenticated (Subscriber+) PHP Object Injection

MEDIUM 44

The Betheme theme for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 26.5.1.4 via deserialization of untrusted input supplied via the import, mfn-items-import-page, and mfn-items-import…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02218 Published 2022-11-21 No fix listed CWE-502

TI-2024-02509 CVE-2024-2694 · GHSA-76j5-j37r-gjv3

Betheme <= 27.5.6 - Authenticated (Contributor+) PHP Object Injection

MEDIUM 41

The Betheme theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 27.5.6 via deserialization of untrusted input of the 'mfn-page-items' post meta value.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00623 Published 2024-08-30 No fix listed CWE-502

TI-2022-22322 CVE-2022-45356 · GHSA-589j-x7qv-7xxp

WordPress Betheme premium theme <= 26.6.1 - Broken Access Control vulnerability

LOW 39

Missing Authorization vulnerability in Muffingroup Betheme.This issue affects Betheme: from n/a through 26.6.1.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00536 Published 2024-03-25 No fix listed CWE-862

TI-2022-22167 CVE-2022-45077 · GHSA-pwpx-r9xc-fhg4

WordPress Betheme theme <= 26.5.1.4 - Auth. PHP Object Injection vulnerability

LOW 39

Auth. (subscriber+) PHP Object Injection vulnerability in Betheme theme <= 26.5.1.4 on WordPress.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00684 Published 2022-11-17 No fix listed CWE-502

TI-2023-20890 CVE-2023-39998 · GHSA-7gqm-c625-582w

WordPress BeTheme theme <= 27.1.1 - Author+ Broken Access Control vulnerability

LOW 36

Missing Authorization vulnerability in Muffingroup Betheme.This issue affects Betheme: from n/a through 27.1.1.

CVSS 3.1HIGH 8.2 Network High privileges No interaction EPSS 0.00457 Published 2024-06-19 No fix listed CWE-862

TI-2022-22319 CVE-2022-45353 · GHSA-hp3q-747r-8rpp

WordPress Betheme theme <= 26.6.1 is vulnerable to Broken Access Control

LOW 36

Broken Access Control in Betheme theme <= 26.6.1 on WordPress.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.0051 Published 2023-01-14 No fix listed CWE-863

TI-2023-25880 CVE-2023-47770 · GHSA-vhfx-77qc-h5hr

WordPress BeTheme theme <= 27.1.1 - Contributor+ Broken Access Control vulnerability

LOW 33

Missing Authorization vulnerability in Muffin Group Betheme.This issue affects Betheme: from n/a through 27.1.1.

CVSS 3.1HIGH 7.6 Network Low privileges No interaction EPSS 0.00289 Published 2024-06-19 No fix listed CWE-862

TI-2023-13543 CVE-2023-29101 · GHSA-hf3g-33gp-h76v

WordPress Betheme Theme <= 26.7.5 is vulnerable to Cross Site Scripting (XSS)

LOW 31

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Muffingroup Betheme theme <= 26.7.5 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00382 Published 2023-05-10 No fix listed CWE-79

TI-2025-02689 CVE-2025-3077 · GHSA-6476-gj69-54v6

Betheme <= 28.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

LOW 28

The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button shortcode and Custom CSS field in all versions up to, and including, 28.0.3 due to insufficient input sanitization and…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00285 Published 2025-04-16 No fix listed CWE-79

TI-2025-00367 CVE-2025-0450 · GHSA-hq4j-7m45-9jhp

Betheme <= 27.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS

LOW 28

The Betheme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom JS functionality in all versions up to, and including, 27.6.1 due to insufficient input sanitization and output escapi…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00247 Published 2025-01-21 No fix listed CWE-79

TI-2024-05173 CVE-2024-5567 · GHSA-7q39-g4rg-578j

Cross-site scripting in MuffinGroup Betheme

LOW 28

The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 27.5.5 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00322 Published 2024-09-13 No fix listed CWE-79

TI-2024-03730 CVE-2024-3998 · GHSA-px2r-hc96-6x9w

Cross-site scripting in MuffinGroup Betheme

LOW 28

The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's shortcodes in all versions up to, and including, 27.5.6 due to insufficient input sanitization and output escaping…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00263 Published 2024-08-30 No fix listed CWE-79

TI-2022-22329 CVE-2022-45363 · GHSA-cxvg-72p4-7x8f

WordPress Betheme premium theme <= 26.6.1 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

LOW 25

Auth. (subscriber+) Stored Cross-Site Scripting (XSS) in Muffingroup Betheme theme <= 26.6.1 on WordPress.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00424 Published 2022-11-22 No fix listed CWE-79

TI-2022-22318 CVE-2022-45352 · GHSA-wcqr-c98g-grwq

WordPress Betheme premium theme <= 26.6.1 - Broken Access Control vulnerability

LOW 25

Missing Authorization vulnerability in Muffingroup Betheme.This issue affects Betheme: from n/a through 26.6.1.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00405 Published 2024-03-25 No fix listed CWE-862

TI-2022-22317 CVE-2022-45351 · GHSA-387v-g9vc-rrrf

WordPress Betheme premium theme <= 26.6.1 - Broken Access Control vulnerability

LOW 25

Missing Authorization vulnerability in Muffingroup Betheme.This issue affects Betheme: from n/a through 26.6.1.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00465 Published 2024-03-25 No fix listed CWE-862

TI-2022-22315 CVE-2022-45349 · GHSA-3h8c-h67v-4vg7

WordPress Betheme premium theme <= 26.6.1 - Broken Access Control vulnerability

LOW 20

Missing Authorization vulnerability in Muffingroup Betheme.This issue affects Betheme: from n/a through 26.6.1.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00405 Published 2024-03-25 No fix listed CWE-862

Open these records in search →