CVE-2026-102798
MediumCVSS 6.5Summary
A stored XSS vulnerability in ThemeREX Addons (trx_addons) by ThemeREX Group allows persistent injection of malicious scripts. Affects versions from n/a through 2.46.0.
Risk Assessment
An attacker can inject a persistent script that executes on every user visit, potentially leading to data theft, session hijacking, or other malicious activities.
Recommendation
It is recommended to upgrade ThemeREX Addons to a version newer than 2.46.0 and apply appropriate anti-XSS protections.
Other vulnerabilities in ThemeREX Addons
See all- CVE-2026-102797Medium
The ThemeREX Addons plugin (up to and including version 2.46.0) is vulnerable to Server-Side Request Forgery (SSRF). This allows an attacker to force the server to make requests to resources it should not normally access.
- CVE-2026-97236Medium
Cross Site Scripting (XSS) vulnerability in ThemeREX Addons before version 2.45.0. A subscriber can inject malicious scripts.
- CVE-2026-97235High
Unauthenticated XSS attack in ThemeREX Addons plugin versions prior to 2.45.0. An attacker can inject malicious script without authentication.
- CVE-2026-62105Critical
Unauthenticated PHP Object Injection in ThemeREX Addons versions below 2.45.0.
- CVE-2025-60205Critical
There is an unauthenticated PHP Object Injection vulnerability in ThemeREX Addons versions <= 2.36.1.1.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Stored XSS.This issue affects ThemeREX Addons: from n/a through 2.46.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS