CVE-2026-94415: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Muffingroup Betheme

The vulnerability CVE-2026-94415 in Muffingroup Betheme is a reflected cross-site scripting (XSS) flaw caused by improper neutralization of input during web page generation. This allows an attacker to inject malicious scripts that are reflected back to users, potentially leading to information disclosure, session hijacking, or other impacts. The issue affects Betheme versions from the initial release through 28.5.8. The CVSS v3.1 base score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this reflected XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of the victim's browser, leading to partial compromise of confidentiality, integrity, and availability of the affected application and user data. This may result in theft of sensitive information, session hijacking, or other malicious actions within the scope of the affected web application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should apply standard XSS mitigations such as input validation and output encoding where possible. Monitor vendor channels for updates and apply patches promptly once released.