Skip to content
OpenAdvisories

Vendor

Muffin Group

26 known vulnerabilities.

Products

Betheme 24 Betheme (WordPress theme) 1 Becustom 1
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • High 7.1
    CVE-2026-94415

    WordPress Betheme theme <= 28.5.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Muffingroup Betheme betheme allows Reflected XSS.This issue affects Betheme: from n/a through 28.5.8.

    Muffin Group Betheme
  • High 8.8
    CVE-2026-6261

    Betheme <= 28.4 - Authenticated (Author+) Arbitrary File Upload to Remote Code Execution via Icon Pack Upload

    The Betheme theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 28.4. This is due to the upload_icons() function workflow moving and unzipping user-controlled ZIP files into a public uploads directory without validatin…

    Muffin Group Betheme Web / CMS
  • High 8.8
    CVE-2024-2694

    Betheme <= 27.5.6 - Authenticated (Contributor+) PHP Object Injection

    The Betheme theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 27.5.6 via deserialization of untrusted input of the 'mfn-page-items' post meta value. This makes it possible for authenticated attackers, with contrib…

    Muffin Group Betheme Web / CMS
  • High 8.2
    CVE-2023-39998

    WordPress BeTheme theme <= 27.1.1 - Author+ Broken Access Control vulnerability

    Missing Authorization vulnerability in Muffingroup Betheme.This issue affects Betheme: from n/a through 27.1.1.

    Muffin Group Betheme
  • High 7.6
    CVE-2023-47770

    WordPress BeTheme theme <= 27.1.1 - Contributor+ Broken Access Control vulnerability

    Missing Authorization vulnerability in Muffin Group Betheme.This issue affects Betheme: from n/a through 27.1.1.

    Muffin Group Betheme
  • High 7.1
    CVE-2023-29101

    WordPress Betheme Theme <= 26.7.5 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Muffingroup Betheme theme <= 26.7.5 versions.

    Muffin Group Betheme
  • High 8.8
    CVE-2022-3747

    Becustom <= 1.0.5.2 - Cross-Site Request Forgery

    The Becustom plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.5.2. This is due to missing nonce validation when saving the plugin's settings. This makes it possible for unauthenticated attackers to update …

    Muffin Group Becustom Web / CMS
  • High 8.8
    CVE-2022-3861

    Betheme <= 26.5.1.4 - Authenticated (Subscriber+) PHP Object Injection

    The Betheme theme for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 26.5.1.4 via deserialization of untrusted input supplied via the import, mfn-items-import-page, and mfn-items-import parameters passed through the mfn_buil…

    Muffin Group Betheme Web / CMS