What the vulnerability does
01Description
Multiple plugins and/or themes for WordPress using Smart Framework are vulnerable to Stored Cross-Site Scripting due to a missing capability check on the saveOptions() and importThemeOptions() functions in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugin's settings which includes custom JavaScript that is enabled site-wide. This issue was escalated to Envato over two months from the date of this disclosure and the issue is still vulnerable.
Explanation of Vulnerability in Simple Terms
02Summary
The Benaa Framework contains an authorization bypass that allows authenticated users with low privileges to access or modify data they should not have permission to reach. The vulnerability affects all versions up to 4.0.0. An attacker needs a valid user account to exploit this flaw, which could lead to unauthorized data disclosure or modification across the application.
What an attacker can do
03Attacker Capabilities
Read or modify data belonging to other users or restricted areas of the site.
Potential impact on your site
04Site Impact
User data and site content may be exposed to or modified by unauthorized account holders.
Conditions required to exploit
05Prerequisites
Attacker must have a valid user account with low-level privileges.
Key dates
06Disclosure timeline
May 2, 2025
CVE published
April 8, 2026
Record updated
