CVE-2026-102798: WordPress ThemeREX Addons plugin <= 2.46.0 - Cross Site Scripting (XSS) vulnerability

Q: Who can exploit this issue?

An attacker needs at least low-level privileges in WordPress and must be able to induce a user to interact with the crafted content. The attack can be performed over the network with low complexity.

Q: What is the potential impact?

Successful exploitation can result in stored cross-site scripting, allowing attacker-supplied script to execute in affected pages. The supplied severity vector indicates low impacts to confidentiality, integrity, and availability, with scope changed.

Q: Which versions are affected?

ThemeREX Addons versions through 2.46.0 are affected. The available data does not identify a fixed version.

Published Oct 2, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group ThemeREX Addons trxaddons allows Stored XSS.This issue affects ThemeREX Addons: from n/a through 2.46.0.

Affected Software

1 affected component

ThemeREX Group ThemeREX Addons<=2.46.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress ThemeREX Addons to a version that resolves this vulnerability.
Fixed in 2.47.0

Event History

Oct 2, 2026

CVE Published

via MITRE·12:38 PM

Data Sourced

via MITRE·12:38 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs at least low-level privileges in WordPress and must be able to induce a user to interact with the crafted content. The attack can be performed over the network with low complexity.

What is the potential impact?