CVE-2026-97236
MediumCVSS 6.5Summary
Cross Site Scripting (XSS) vulnerability in ThemeREX Addons before version 2.45.0. A subscriber can inject malicious scripts.
Risk Assessment
Risk of session theft, account takeover, or unauthorized actions in an administrator's browser.
Recommendation
Update the ThemeREX Addons plugin to version 2.45.0 or later.
Other vulnerabilities in ThemeREX Addons
See all- CVE-2026-102798Medium
A stored XSS vulnerability in ThemeREX Addons (trx_addons) by ThemeREX Group allows persistent injection of malicious scripts. Affects versions from n/a through 2.46.0.
- CVE-2026-102797Medium
The ThemeREX Addons plugin (up to and including version 2.46.0) is vulnerable to Server-Side Request Forgery (SSRF). This allows an attacker to force the server to make requests to resources it should not normally access.
- CVE-2026-97235High
Unauthenticated XSS attack in ThemeREX Addons plugin versions prior to 2.45.0. An attacker can inject malicious script without authentication.
- CVE-2026-62105Critical
Unauthenticated PHP Object Injection in ThemeREX Addons versions below 2.45.0.
- CVE-2025-60205Critical
The ThemeREX Addons plugin (up to 2.36.1.1) contains a deserialization of untrusted data vulnerability that allows object injection. An attacker could exploit this flaw to execute malicious code within the WordPress application context.
Original NVD description (English source)
Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS