CVE-2025-63075
MEDIUMCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
2Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in muffingroup Betheme betheme allows DOM-Based XSS.This issue affects Betheme: from n/a through <= 28.2.
Analysis
DOM-based cross-site scripting (XSS) in muffingroup Betheme WordPress theme versions up to 28.2 allows authenticated attackers with low privileges to inject malicious scripts that execute in the context of other users' browsers. The vulnerability requires user interaction (UI:R) and affects the confidentiality, integrity, and availability of affected installations; EPSS exploitation probability is low at 0.04%, and no public exploit code or active exploitation has been confirmed.
Technical Context
This is a CWE-79 DOM-based XSS vulnerability in a WordPress theme that fails to properly neutralize user-controlled input during web page generation. The attack vector is network-based with low complexity, meaning an attacker can craft a malicious link or embed a payload in a web request without advanced techniques. The vulnerability requires prior authentication (PR:L) and user interaction (UI:R), indicating the attacker must trick an authenticated user into clicking a link or performing an action that triggers the XSS payload. The Betheme theme, distributed via WordPress.org, processes user input in the DOM without adequate sanitization or output encoding, allowing script injection. The scope change (S:C) indicates the impact extends beyond the vulnerable component to affect other security domains.
Affected Products
muffingroup Betheme WordPress theme versions from an unspecified baseline through and including version 28.2. The theme is distributed via WordPress.org and is identified by CPE muffingroup Betheme. Detailed version-by-version impact scope is not provided in available data, though the advisory indicates all versions up to 28.2 are affected. Users should verify their current Betheme version in the WordPress admin dashboard to determine if they are within the vulnerable range.
Remediation
Update Betheme to a patched version released after 28.2. WordPress administrators should navigate to Appearance > Themes, locate Betheme, and apply any available updates; most patched versions should appear automatically in the WordPress update notification system. If automatic updates are disabled, manually download the latest Betheme release from the official WordPress.org theme repository. For additional guidance and confirmation of the patched version number, consult the advisory published at https://patchstack.com/database/Wordpress/Theme/betheme/vulnerability/wordpress-betheme-theme-28-1-7-cross-site-scripting-xss-vulnerability. No active workarounds are available; patching is the primary remediation path.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today