# cve.now: Muffingroup

The newest entries naming Muffingroup as an affected vendor (up to 200), of 25 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-94415](https://cve.now/CVE-2026-94415.md): WordPress Betheme theme \<= 28.5.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-6178](https://cve.now/CVE-2026-6178.md): Betheme \<= 28.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon\_box\_2' Shortcode (CVSS 6.4)
- [CVE-2026-65548](https://cve.now/CVE-2026-65548.md): WordPress Betheme theme \<= 28.4.2 - Remote Code Execution (RCE) vulnerability (CVSS 9.9)
- [CVE-2026-6261](https://cve.now/CVE-2026-6261.md): Betheme \<= 28.4 - Authenticated (Author+) Arbitrary File Upload to Remote Code Execution via Icon Pack Upload (CVSS 8.8)
- [CVE-2026-6262](https://cve.now/CVE-2026-6262.md): Betheme \<= 28.4 - Authenticated (Contributor+) Arbitrary File Deletion via 'mfn-icon-upload' (CVSS 6.5)
- [CVE-2025-63075](https://cve.now/CVE-2025-63075.md): WordPress Betheme theme \<= 28.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-9371](https://cve.now/CVE-2025-9371.md): Betheme \<= 28.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'page\_title' (CVSS 6.4)
- [CVE-2025-7399](https://cve.now/CVE-2025-7399.md): Betheme \<= 28.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-5647](https://cve.now/CVE-2024-5647.md): Multiple Plugins \<= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library (CVSS 6.4)
- [CVE-2025-3077](https://cve.now/CVE-2025-3077.md): Betheme \<= 28.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2025-0450](https://cve.now/CVE-2025-0450.md): Betheme \<= 27.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS (CVSS 6.4)
- [CVE-2024-5567](https://cve.now/CVE-2024-5567.md): Betheme | Responsive Multipurpose WordPress & WooCommerce Theme \<= 27.5.5 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File (CVSS 6.4)
- [CVE-2024-2694](https://cve.now/CVE-2024-2694.md): Betheme \<= 27.5.6 - Authenticated (Contributor+) PHP Object Injection (CVSS 8.8)
- [CVE-2024-3998](https://cve.now/CVE-2024-3998.md): Betheme | Responsive Multipurpose WordPress & WooCommerce Theme \<= 27.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
- [CVE-2023-39998](https://cve.now/CVE-2023-39998.md): WordPress BeTheme theme \<= 27.1.1 - Author+ Broken Access Control vulnerability (CVSS 8.2)
- [CVE-2022-45356](https://cve.now/CVE-2022-45356.md): WordPress Betheme premium theme \<= 26.6.1 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2022-45352](https://cve.now/CVE-2022-45352.md): WordPress Betheme premium theme \<= 26.6.1 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2022-45351](https://cve.now/CVE-2022-45351.md): WordPress Betheme premium theme \<= 26.6.1 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2022-45349](https://cve.now/CVE-2022-45349.md): WordPress Betheme premium theme \<= 26.6.1 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2023-29101](https://cve.now/CVE-2023-29101.md): WordPress Betheme Theme \<= 26.7.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1)
- [CVE-2022-45353](https://cve.now/CVE-2022-45353.md): WordPress Betheme theme \<= 26.6.1 is vulnerable to Broken Access Control (CVSS 4.3)
- [CVE-2022-3747](https://cve.now/CVE-2022-3747.md): Becustom \<= 1.0.5.2 - Cross-Site Request Forgery (CVSS 8.8)
- [CVE-2022-45363](https://cve.now/CVE-2022-45363.md): WordPress Betheme premium theme \<= 26.6.1 - Auth. Stored Cross-Site Scripting (XSS) vulnerability (CVSS 5.4)
- [CVE-2022-3861](https://cve.now/CVE-2022-3861.md): Betheme \<= 26.5.1.4 - Authenticated (Subscriber+) PHP Object Injection (CVSS 8.8)
- [CVE-2022-45077](https://cve.now/CVE-2022-45077.md): WordPress Betheme theme \<= 26.5.1.4 - Auth. PHP Object Injection vulnerability (CVSS 6.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/muffingroup
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.