CVE-2026-97236: WordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scripting (XSS) vulnerability
Published Sep 30, 2026
·Updated
Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.
Affected Software
1 affected component
ThemeREX ThemeREX Addons<2.45.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress ThemeREX Addons Pluginto a version that resolves this vulnerability.Fixed in 2.45.0
Event History
Sep 30, 2026
CVE Published
via MITRE·12:27 PM
Data Sourced
via MITRE·12:27 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·01:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
A user with Subscriber-level access can exploit the XSS vulnerability. Exploitation also requires user interaction.
2
Which installations are affected?
ThemeREX Addons versions earlier than 2.45.0 are affected. The provided information does not state whether any particular default configuration is required.
3
What is the potential impact?
Successful exploitation can affect confidentiality, integrity, and availability, with scope changed. The listed severity is medium, with a CVSS score of 6.5.