CVE-2026-6178: Betheme <= 28.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_box_2' Shortcode
The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's 'iconbox2' shortcode in all versions up to, and including, 28.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Betheme (WordPress theme)to a version that resolves this vulnerability.Fixed in 28.4 - Compensating control
Mitigate the risk by restricting who can create/edit pages and content in WordPress to trusted users only (since the vulnerability is exploitable by authenticated attackers with Contributor+ access).
Event History
Frequently Asked Questions
Which users can exploit this issue?
An attacker needs an authenticated WordPress account with Contributor-level permissions or higher. They must be able to submit content containing the icon_box_2 shortcode and its vulnerable attributes.
Who is exposed to the injected script?
The script executes when a user accesses a page containing the attacker-injected shortcode. This can affect any user who views the injected page, including users with higher privileges.
Which versions are affected?
Betheme versions up to and including 28.4 are affected. The provided data does not identify a fixed version.