The Betheme theme contains a Stored Cross‑Site Scripting flaw due to insufficient sanitization of user input in the Button shortcode and Custom CSS fields. Serialized content is rendered without proper escaping, allowing injection of arbitrary JavaScript that executes whenever any user views the affected page. This could enable attackers to steal cookies, hijack sessions, deface content, or execute additional malicious payloads, thereby compromising confidentiality, integrity, and potentially availability.

All versions of the Betheme theme for WordPress up to and including 28.0.3 are affected. The vendor identified is MuffinGroup, using the Betheme product. No further vendor or product granularity is supplied beyond this range.

The vulnerability is rated 6.4 on CVSS, indicating a medium severity level. The EPSS score is below 1 %, suggesting a low likelihood of exploitation at the present moment, and the issue is not included in the CISA KEV catalog. The attack vector is authenticated, requiring at least Contributor level access. An attacker with this privilege can edit pages or posts, inject malicious code via the shortcode or custom CSS, and persist it, allowing the script to run on subsequent page loads for all visitors.