The vulnerability is an Improper Neutralization of Input During Web Page Generation that permits reflected cross‑site scripting. The flaw allows an attacker to inject malicious JavaScript code into pages generated by the Betheme theme, which is then executed in the browser of any user who visits the affected site. This injection can be used to steal session data, deface content, or redirect users to malicious domains. The weakness is a classic input validation issue, documented as CWE‑79.

Muffingroup Betheme theme for WordPress versions up to and including 28.5.8 are affected. No earlier version is listed as vulnerable, and the issue does not appear in later releases.

The vulnerability carries a CVSS score of 7.1, indicating moderate to high severity. An EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is a reflected XSS scenario in which an attacker crafts a URL or submits crafted input that is incorporated into HTTP responses; a victim who follows the link or submits the input will have the injected script executed within the context of the site. While it does not provide remote code execution or privilege escalation, it can be leveraged for sophisticated phishing or user‑tracking campaigns.