Betheme
- Software type
- Website builder
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 10/21/2026, Betheme recorded 3 security vulnerabilities in the last 90 days, of which 2 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of Betheme and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-94415WordPress Betheme theme <= 28.5.8 - Cross Site Scripting (XSS) vulnerabilityCVE-2026-6178Betheme <= 28.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_box_2' ShortcodeCVE-2026-65548WordPress Betheme theme <= 28.4.2 - Remote Code Execution (RCE) vulnerabilityCVE-2026-6261Betheme <= 28.4 - Authenticated (Author+) Arbitrary File Upload to Remote Code Execution via Icon Pack UploadCVE-2026-6262Betheme <= 28.4 - Authenticated (Contributor+) Arbitrary File Deletion via 'mfn-icon-upload'| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-94415WordPress Betheme theme <= 28.5.8 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes |
| SeverityHigh |
CVE-2026-6178Betheme <= 28.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_box_2' Shortcode | Exploitation statusNot exploited | FixYes | Published08/26/2026 | SeverityMedium |
|---|
CVE-2026-65548WordPress Betheme theme <= 28.4.2 - Remote Code Execution (RCE) vulnerability | Exploitation statusNot exploited | FixYes | Published08/06/2026 | SeverityCritical |
|---|
CVE-2026-6261Betheme <= 28.4 - Authenticated (Author+) Arbitrary File Upload to Remote Code Execution via Icon Pack Upload | Exploitation statusNot exploited | FixYes | Published05/05/2026 | SeverityHigh |
|---|
CVE-2026-6262Betheme <= 28.4 - Authenticated (Contributor+) Arbitrary File Deletion via 'mfn-icon-upload' | Exploitation statusNot exploited | FixYes | Published05/05/2026 | SeverityMedium |
|---|
CVE-2025-63075WordPress Betheme theme <= 28.2 - Cross Site Scripting (XSS) vulnerability | Exploitation statusNot exploited | FixYes | Published12/09/2025 | SeverityMedium |
|---|
CVE-2025-9371Betheme <= 28.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'page_title' | Exploitation statusNot exploited | FixYes | Published10/09/2025 | SeverityMedium |
|---|
CVE-2025-7399Betheme <= 28.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting | Exploitation statusNot exploited | FixYes | Published08/06/2025 | SeverityMedium |
|---|
CVE-2024-5647Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library | Exploitation statusNot exploited | FixYes | Published07/03/2025 | SeverityMedium |
|---|
CVE-2025-3077Betheme <= 28.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting | Exploitation statusNot exploited | FixYes | Published04/16/2025 | SeverityMedium |
|---|
25 Results | Page 1 of 3