Security Alert Summary
The Betheme theme for WordPress is affected by a stored Cross-Site Scripting (XSS) vulnerability in the theme’s icon_box_2 shortcode in all versions up to and including 28.4. Insufficient input sanitization and output escaping of user-supplied attributes allows authenticated users with contributor-level access or higher to inject scripts that execute when an injected page is viewed.
CVE Details
- CVE ID: CVE-2026-6178
- Affected product: Betheme theme for WordPress
- Affected versions: all versions up to and including 28.4
- Published: August 26, 2026 at 08:16:45 AM UTC
- Last modified: August 26, 2026 at 04:19:05 PM UTC
- CVSS v3.1: Base Score 6.4, Severity MEDIUM, Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Authentication / Privileges / User interaction: Requires an authenticated user. Privileges required: Low (PR:L). User interaction: None (UI:N). The description notes exploitation by authenticated attackers with contributor-level access and above.
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
- Weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-site Scripting)
Technical Details
This vulnerability is a stored Cross-Site Scripting issue in the theme’s icon_box_2 shortcode. The theme does not sufficiently sanitize or escape user-supplied attributes used by that shortcode, allowing attacker-supplied HTML or script payloads to be persisted in page content.
Because the injected content is stored in the page and rendered when the page is viewed, any user who visits the affected page may execute the injected script in their browser context. The vulnerability arises from missing input sanitization and output escaping for the shortcode attributes; those specific attribute handling paths are referenced in the theme’s shortcode implementation (see references).
Impact is limited to the confidentiality and integrity of data accessible to the attacked user and the ability to perform actions available to that user in the context of their browser session. The CVSS vector indicates network attack vector, low attack complexity, and no required user interaction, with scope changed.
How This Could Impact Your Website
Consider a site where the site owner manages content and delegates editing tasks to internal staff and external contractors. If an attacker with contributor-level access or higher injects a malicious script via the icon_box_2 shortcode, that script could execute when other users view the affected page. Practical consequences include exposure of information visible to visiting users or the ability to perform actions in the context of a viewer’s browser session.
Realistic scenarios include unintended disclosure of internal email addresses visible on a page or modification of page content that could be used to craft targeted phishing or social engineering campaigns against staff or contributors. The direct technical impact here is limited (as indicated by the CVSS low confidentiality and integrity ratings), but the resulting information exposure or trust abuse can enable further attacks.
If you\’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected theme as soon as a patched version is available.
- Review and reduce unnecessary user roles; limit contributor-level access where not required.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained themes and plugins from the site.
- Monitor site activity and audit recent content changes for unexpected or malicious markup.
If you\’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/betheme/tags/28.3.3/functions/theme-shortcodes.php#L11651
- https://plugins.trac.wordpress.org/browser/betheme/tags/28.3.3/functions/theme-shortcodes.php#L11719
- https://plugins.trac.wordpress.org/browser/betheme/tags/28.3.3/functions/theme-shortcodes.php#L11840
- https://plugins.trac.wordpress.org/browser/betheme/trunk/functions/theme-shortcodes.php#L11651
- https://plugins.trac.wordpress.org/browser/betheme/trunk/functions/theme-shortcodes.php#L11719
- https://plugins.trac.wordpress.org/browser/betheme/trunk/functions/theme-shortcodes.php#L11840
- https://support.muffingroup.com/changelog/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/686dd63b-5471-4654-8009-e3ab648f8b86?source=cve
