CVE-2026-97235: WordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scripting (XSS) vulnerability
Published Sep 30, 2026
·Updated
Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.
Affected Software
1 affected component
ThemeREX ThemeREX Addons<2.45.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress ThemeREX Addons Pluginto a version that resolves this vulnerability.Fixed in 2.45.0
Event History
Sep 30, 2026
CVE Published
via MITRE·12:27 PM
Data Sourced
via MITRE·12:27 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·01:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
The vulnerability is unauthenticated, so an attacker does not need a WordPress account or other prior privileges. Exploitation does require user interaction, as reflected by the UI:R vector.
2
Which installations are affected?
ThemeREX Addons versions earlier than 2.45.0 are affected. The provided data does not identify any configuration requirement or workaround for unpatched installations.