High
CVE-2026-94415
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 26
Reset filters
Medium
CVE-2026-6178
Betheme <= 28.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_box_2' Shortcode
High
CVE-2026-65548
Betheme <= 28.5.7 - Authenticated (Contributor+) Remote Code Execution
High
CVE-2026-6261
Betheme <= 28.4 - Authenticated (Author+) Arbitrary File Upload to Remote Code Execution via Icon Pack Upload
Medium
CVE-2026-6262
Betheme <= 28.4 - Authenticated (Contributor+) Arbitrary File Deletion via 'mfn-icon-upload'
Medium
CVE-2025-9371
Betheme <= 28.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'page_title'
Medium
CVE-2025-63075
Betheme <= 28.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-7399
Betheme <= 28.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-5647
Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library
Medium
CVE-2025-3077
Betheme <= 28.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-0450
Betheme <= 27.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS
Medium
CVE-2024-5567
Betheme | Responsive Multipurpose WordPress & WooCommerce Theme <= 27.5.5 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File
Medium
CVE-2024-3998
Betheme | Responsive Multipurpose WordPress & WooCommerce Theme <= 27.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
High
CVE-2024-2694
Betheme <= 27.5.6 - Authenticated (Contributor+) PHP Object Injection
Medium
CVE-2023-47770
Betheme <= 27.1.1 - Missing Authorization
Medium
CVE-2023-39998
Betheme <= 27.1.1 - Missing Authorization via '_tool_history_delete'
Medium
CVE-2023-29101
Betheme <= 26.7.5 - Reflected Cross-Site Scripting
Medium
CVE-2022-45353
Betheme <= 26.6.2 - Missing Authorization Checks to Private Page/Post Data Disclosure
High
CVE-2022-45356
Betheme <= 26.6.2 - Missing Authorization Check on Core Functionality
Medium
CVE-2022-45351
Betheme <= 26.6.2 - Missing Authorization to Post Status Change
Medium
CVE-2022-45349
Betheme <= 26.6.2 - Missing Authorization to Post Title Change
Medium
CVE-2022-45363
Betheme <= 26.6.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2022-45352
Betheme <= 26.6.2 - Missing Authorization to Theme Settings Update
High
CVE-2022-3861
Betheme <= 26.5.1.4 - Authenticated (Subscriber+) PHP Object Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.