CVE-2025-3077

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-3077", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-03-31T23:24:28.234Z", "datePublished": "2025-04-16T07:31:09.016Z", "dateUpdated": "2026-04-08T17:02:17.401Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:02:17.401Z"}, "affected": [{"vendor": "MuffinGroup", "product": "Betheme", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "28.0.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button shortcode and Custom CSS field in all versions up to, and including, 28.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Betheme <= 28.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7a0a281d-840f-488f-b9ef-c0df8514b47c?source=cve"}, {"url": "https://themeforest.net/item/betheme-responsive-multipurpose-wordpress-theme/7758048"}, {"url": "https://support.muffingroup.com/changelog/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Craig Smith"}], "timeline": [{"time": "2025-04-15T19:05:04.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-16T13:15:06.971540Z", "id": "CVE-2025-3077", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-16T14:34:53.820Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-3077", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-16T13:15:06.971540Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-16T14:11:36.891Z"}}], "cna": {"title": "Betheme <= 28.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "Craig Smith"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "MuffinGroup", "product": "Betheme", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "28.0.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-04-15T19:05:04.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7a0a281d-840f-488f-b9ef-c0df8514b47c?source=cve"}, {"url": "https://themeforest.net/item/betheme-responsive-multipurpose-wordpress-theme/7758048"}, {"url": "https://support.muffingroup.com/changelog/"}], "descriptions": [{"lang": "en", "value": "The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button shortcode and Custom CSS field in all versions up to, and including, 28.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:02:17.401Z"}}}, "cveMetadata": {"cveId": "CVE-2025-3077", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:02:17.401Z", "dateReserved": "2025-03-31T23:24:28.234Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-04-16T07:31:09.016Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Betheme", "vendor": "MuffinGroup", "versions": [{"lessThanOrEqual": "28.0.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:muffingroup:betheme:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "7FE536AD-17CC-4E7A-8FD2-4B8D43BBC746", "versionEndExcluding": "28.0.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button shortcode and Custom CSS field in all versions up to, and including, 28.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El tema Betheme para WordPress es vulnerable a Cross-Site Scripting almacenado a trav\u00e9s del shortcode del bot\u00f3n y el campo CSS personalizado del complemento en todas las versiones hasta la 28.0.3 incluida, debido a una depuraci\u00f3n de entrada y al escape de salida insuficiente en los atributos proporcionados por el usuario. Esto permite a atacantes autenticados, con acceso de colaborador o superior, inyectar scripts web arbitrarios en las p\u00e1ginas que se ejecutar\u00e1n al acceder un usuario a una p\u00e1gina inyectada."}], "id": "CVE-2025-3077", "lastModified": "2026-06-17T09:19:09.177", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-3077", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-04-16T13:15:06.971540Z", "version": "2.0.3"}}]}, "published": "2025-04-16T08:15:14.500", "references": [{"source": "security@wordfence.com", "tags": ["Release Notes"], "url": "https://support.muffingroup.com/changelog/"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://themeforest.net/item/betheme-responsive-multipurpose-wordpress-theme/7758048"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7a0a281d-840f-488f-b9ef-c0df8514b47c?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T21:18:29.950759+00:00", "value": {"mitigation_remediation": ["Update the Betheme theme to the latest version (greater than 28.0.3) where the input validation and output escaping flaws have been corrected.", "After updating, audit all pages and posts that previously contained custom CSS or button shortcodes to ensure no residual script remains and remove any unexpected content that may have been stored by an attacker.", "Re\u2011evaluate the access permissions for the Contributor role within WordPress to minimize the scope of potential stored\u2011XSS injection."], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting that can be triggered by authenticated Contributors or higher in the Betheme WordPress theme"}, "threat_synthesis": {"affected_systems": "All versions of the Betheme theme for WordPress up to and including 28.0.3 are affected. The vendor identified is MuffinGroup, using the Betheme product. No further vendor or product granularity is supplied beyond this range.", "description_and_impact": "The Betheme theme contains a Stored Cross\u2011Site Scripting flaw due to insufficient sanitization of user input in the Button shortcode and Custom CSS fields. Serialized content is rendered without proper escaping, allowing injection of arbitrary JavaScript that executes whenever any user views the affected page. This could enable attackers to steal cookies, hijack sessions, deface content, or execute additional malicious payloads, thereby compromising confidentiality, integrity, and potentially availability.", "risk_and_exploitability": "The vulnerability is rated 6.4 on CVSS, indicating a medium severity level. The EPSS score is below 1\u202f%, suggesting a low likelihood of exploitation at the present moment, and the issue is not included in the CISA KEV catalog. The attack vector is authenticated, requiring at least Contributor level access. An attacker with this privilege can edit pages or posts, inject malicious code via the shortcode or custom CSS, and persist it, allowing the script to run on subsequent page loads for all visitors."}}}}, "created": "2026-04-21T21:30:45.737673+00:00", "updated": "2026-04-21T21:30:45.737689+00:00", "vendors": []}