Description

The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's 'icon_box_2' shortcode in all versions up to, and including, 28.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-08-26T08:16:45.783Z",
  "pubdate": "2026-08-26T08:16:45.783Z",
  "executiveSummary": "Betheme versions up to and including 28.4 contain a Stored Cross-Site Scripting (XSS) vulnerability located within the 'icon_box_2' shortcode.\nThe vulnerability arises from improper handling of user-supplied attributes, allowing authenticated users with at least contributor-level access to inject malicious JavaScript payloads.\nWhen a user or administrator accesses a page containing the compromised shortcode, the injected script executes within the context of their session.\nSuccessful exploitation could lead to unauthorized actions performed on behalf of the victim, session hijacking, or the defacement of the affected website.\nThis vulnerability presents a significant risk to site integrity and user security, as it allows for persistent code execution originating from the application's own content management interface.\nThe attack requires an authenticated user with existing posting privileges to successfully inject the payload into the theme's shortcode parameters.",
  "technicalDetails": "The vulnerability is classified as a Stored Cross-Site Scripting (XSS) issue resulting from inadequate sanitization and output escaping of attributes utilized by the 'icon_box_2' shortcode in Betheme.\nIn the WordPress environment, shortcodes are processed by the theme's backend to render components. The 'icon_box_2' component fails to validate or sanitize inputs provided through its shortcode arguments, such as custom icons, titles, or links.\nWhen a contributor-level user creates or edits a post, they can insert a maliciously crafted 'icon_box_2' shortcode containing an XSS payload within one of the attributes (e.g., setting an attribute to 'javascript:alert(document.domain)').\nBecause the theme does not perform context-aware output escaping when rendering these attributes on the frontend, the browser interprets the injected input as executable code rather than plain text.\nThe attack flow proceeds as follows: First, the attacker, possessing sufficient privileges to create or edit pages, injects the malicious payload into the 'icon_box_2' shortcode parameters. Second, the WordPress database stores this malicious shortcode string. Third, whenever a legitimate user or administrator navigates to the page where this shortcode is rendered, the application processes the shortcode, failing to escape the injected script.\nThe browser of the victim then executes the malicious JavaScript. Depending on the payload, this could include stealing session cookies via document.cookie, performing unauthorized administrative actions via forged requests (CSRF), or redirecting the user to a malicious external site.\nThe impact is persistent, meaning the payload remains active on the page until an administrator removes the malicious shortcode from the post content.\nThis vulnerability is present in all Betheme versions through 28.4, and the lack of robust input filtering mechanisms at the point of processing allows this exploitation path to remain viable for any authenticated user with access to the editor interface."
}