MuffinGroup vulnerabilities
We track 4 vulnerabilities in MuffinGroup products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on October 9, 2026.
Latest MuffinGroup vulnerabilities
- 7.1 High severity
Betheme: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Muffingroup Betheme betheme allows Reflected XSS.This issue affects Betheme: from n/a through 28.5.8.
- 8.8 High severity
Betheme: Unrestricted Upload of File with Dangerous Type
The Betheme theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 28.4. This is due to the upload_icons() function workflow moving and unzipping user-controlled ZIP files into a public uploads directory without validating
- 8.8 High severity
Betheme: Deserialization of Untrusted Data
The Betheme theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 27.5.6 via deserialization of untrusted input of the 'mfn-page-items' post meta value. This makes it possible for authenticated attackers, with contribu
- 8.8 High severity
Betheme: Deserialization of Untrusted Data
The Betheme theme for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 26.5.1.4 via deserialization of untrusted input supplied via the import, mfn-items-import-page, and mfn-items-import parameters passed through the mfn_build