Stored Cross-Site Scripting Vulnerability in Betheme WordPress Theme

CVE-2025-9371

What is CVE-2025-9371?

The Betheme theme for WordPress suffers from a Stored Cross-Site Scripting vulnerability, allowing authenticated users with Contributor-level access and higher to inject arbitrary scripts via the 'page_title' parameter. This weakness stems from inadequate input sanitization and output escaping in the theme's breadcrumb feature. Exploiting this vulnerability enables attackers to execute malicious scripts when users view affected pages, posing significant risks to user data and site integrity.

References