The Betheme plugin for WordPress contains an insufficient input sanitization flaw in its custom JavaScript feature. An authenticated attacker with contributor‑level rights or higher can store malicious scripts in page attributes that get rendered without proper escaping. When any visitor loads the affected page, the injected code runs in the victim’s browser, allowing attackers to steal session cookies, hijack accounts, deface content, or launch further phishing attacks. This constitutes a classic stored XSS that can compromise confidentiality, integrity, and availability of user sessions.

The vulnerability affects all Betheme installations provided by MuffinGroup for WordPress from the earliest release up to and including version 27.6.1. Each affected installation allows contributors and higher‑level users to insert custom JavaScript into pages, making all users of that site potentially vulnerable.

The CVSS score is 6.4, indicating moderate severity, while the EPSS score of less than 1% suggests a low likelihood of immediate exploitation at this time. The flaw is not listed in CISA’s KEV catalog. Because exploitation requires authenticated contributor or higher access, an attacker must first obtain legitimate credentials or compromise an existing contributor account. Once authenticated, the attacker simply inserts malicious JavaScript in the custom JS field through the plugin’s UI, which is then served to all visitors. The impact can be severe if the script performs credential theft or defacement, but the current exploitation probability remains low.