CVE-2026-102797
MediumCVSS 6.4Summary
The ThemeREX Addons plugin (up to and including version 2.46.0) is vulnerable to Server-Side Request Forgery (SSRF). This allows an attacker to force the server to make requests to resources it should not normally access.
Risk Assessment
An attacker could use the server to scan internal networks or reach backend services, potentially leading to data leakage or privilege escalation.
Recommendation
Update the ThemeREX Addons plugin to a version newer than 2.46.0 once a fix is available, and consider restricting outbound network traffic from the web server.
Other vulnerabilities in ThemeREX Addons
See all- CVE-2026-102798Medium
A stored XSS vulnerability in ThemeREX Addons (trx_addons) by ThemeREX Group allows persistent injection of malicious scripts. Affects versions from n/a through 2.46.0.
- CVE-2026-97236Medium
Cross Site Scripting (XSS) vulnerability in ThemeREX Addons before version 2.45.0. A subscriber can inject malicious scripts.
- CVE-2026-97235High
Unauthenticated XSS attack in ThemeREX Addons plugin versions prior to 2.45.0. An attacker can inject malicious script without authentication.
- CVE-2026-62105Critical
Unauthenticated PHP Object Injection in ThemeREX Addons versions below 2.45.0.
- CVE-2025-60205Critical
There is an unauthenticated PHP Object Injection vulnerability in ThemeREX Addons versions <= 2.36.1.1.
Original NVD description (English source)
Server-Side Request Forgery (SSRF) vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Server Side Request Forgery.This issue affects ThemeREX Addons: from n/a through 2.46.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS