Betheme is vulnerable to stored Cross‑Site Scripting because the page_title parameter is not properly sanitized when used in the theme’s breadcrumbs. Authenticated users with Contributor role or higher can inject arbitrary JavaScript that is stored in the page title and executed automatically whenever the page is accessed by any visitor. This attack allows attackers to steal session cookies, deface the site, or execute further malicious actions in the context of visiting users.

All installations of the Betheme WordPress theme from its first public release through version 28.1.6 are affected. Sites running the theme on any WordPress installation with Contributor‑level access or higher are vulnerable to exploitation of this stored‑XSS flaw.

The CVSS score of 6.4 indicates moderate severity, while an EPSS score of less than 1% suggests a currently low probability of exploitation. However, because the vulnerability requires only contributor privileges—a common role on many sites—the risk of in‑site XSS remains significant for administrators who have granted such permissions. The flaw is not yet listed in the CISA KEV catalog, but any user who injects malicious content can infect all subsequent visitors to the affected pages, potentially leading to credential theft or site defacement.