Muffingroup Betheme CVE-2026-94415

Exploitation requires the attacker to deliver a crafted URL containing a malicious script payload to a victim who must then load it in a browser with an active session on a site running Betheme <= 28.5.8 (UI:R is the key limiting factor). No authentication is required of the attacker (PR:N), but because this is reflected rather than stored XSS, impact is confined to victims who interact with the attacker-supplied link - there is no persistent server-side injection. The specific vulnerable parameter/feature is not named in the provided description; impact is greatest when a privileged user (administrator) is tricked into clicking the link.

This is a reflected cross-site scripting flaw (CWE-79) in the Muffingroup Betheme WordPress theme (<= 28.5.8), rated CVSS 7.1 by Patchstack. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L indicates network-reachable, low-complexity, unauthenticated exploitation (PR:N) but is gated by required user interaction (UI:R) - the victim must click or load an attacker-crafted link, which is characteristic of reflected (not stored) XSS. The scope change (S:C) reflects that injected script executes in the victim's browser context rather than the server. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided in the input, so exploitation signals are weak: no public exploit identified at time of analysis. The 'LOW' confidentiality/integrity/availability impacts are consistent with browser-side script execution against individual victims rather than direct server compromise. Net assessment: this is a moderate, user-interaction-dependent issue - a genuine patch-worthy bug but not an emergency; it is not a mass-exploitable, drive-by server flaw. The A:L (availability) impact assigned by the reporter is atypical for reflected XSS and may be overstated - verify against the Patchstack advisory.

An attacker crafts a malicious URL targeting a vulnerable Betheme-rendered page with an unsanitized reflected parameter and lures a logged-in site administrator or visitor to click it (e.g., via phishing). When the page reflects the payload, attacker-controlled JavaScript executes in the victim's browser session, enabling session/cookie theft, admin action forgery, or redirection. No public proof-of-concept was identified in the provided data.