{"id":"CVE-2026-6178","aliases":["EUVD-2026-66334","GHSA-hxjw-xf28-w726"],"status":"published","title":"Betheme \u003c= 28.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_box_2' Shortcode","description":"The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's 'icon_box_2' shortcode in all versions up to, and including, 28.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","severity":{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00357,"percentile":0.29684,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-08-26T07:42:00Z","modified":"2026-08-26T18:32:03Z","products":[{"vendor":"muffingroup","product":"betheme"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/686dd63b-5471-4654-8009-e3ab648f8b86?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/betheme/trunk/functions/theme-shortcodes.php#L11719"},{"url":"https://plugins.trac.wordpress.org/browser/betheme/tags/28.3.3/functions/theme-shortcodes.php#L11719"},{"url":"https://plugins.trac.wordpress.org/browser/betheme/trunk/functions/theme-shortcodes.php#L11651"},{"url":"https://plugins.trac.wordpress.org/browser/betheme/tags/28.3.3/functions/theme-shortcodes.php#L11651"},{"url":"https://plugins.trac.wordpress.org/browser/betheme/trunk/functions/theme-shortcodes.php#L11840"},{"url":"https://plugins.trac.wordpress.org/browser/betheme/tags/28.3.3/functions/theme-shortcodes.php#L11840"},{"url":"https://support.muffingroup.com/changelog/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6178"},{"url":"https://support.muffingroup.com/changelog"},{"url":"https://github.com/advisories/GHSA-hxjw-xf28-w726"}],"sources":{"cve":[{"id":"CVE-2026-6178","title":"Betheme \u003c= 28.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_box_2' Shortcode","description":"The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's 'icon_box_2' shortcode in all versions up to, and including, 28.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2026-08-26T07:42:00.865Z","modified":"2026-08-26T14:51:16.787Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T13:50:04.986624Z"}],"euvd":[{"id":"EUVD-2026-66334","description":"The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's 'icon_box_2' shortcode in all versions up to, and including, 28.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2026-08-26T07:42:00Z","modified":"2026-08-26T14:51:16Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:01:30.898869Z"}],"ghsa":[{"id":"GHSA-hxjw-xf28-w726","title":"The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's ...","description":"The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's 'icon_box_2' shortcode in all versions up to, and including, 28.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2026-08-26T18:31:54Z","modified":"2026-08-26T18:32:03Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:10:59.944342Z"}],"nvd":[{"id":"CVE-2026-6178","description":"The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's 'icon_box_2' shortcode in all versions up to, and including, 28.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2026-08-26T08:16:45.783Z","modified":"2026-08-26T16:19:05.917Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:41.66469Z"}]}}