CVE-2026-94415: WordPress Betheme theme <= 28.5.8 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Muffingroup Betheme betheme allows Reflected XSS.This issue affects Betheme: from n/a through 28.5.8.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Betheme versions through 28.5.8 are affected. The available information does not identify a lower fixed baseline or specify any configuration-dependent exclusions.
What does an attacker need to exploit this issue?
The CVSS vector indicates exploitation is network-accessible, requires low attack complexity, no privileges, and user interaction. An attacker would need to cause a user to interact with a crafted request or page to trigger the reflected XSS.
What is the likely impact if exploitation succeeds?
The stated impacts are low confidentiality, integrity, and availability effects, with scope changed. Successful XSS may allow attacker-controlled script to execute in the context of the affected site user.