CVE-2026-57745
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The RT-Theme 18 | Extensions (rt18-extensions) plugin up to version 2.5 contains a reflected Cross-site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. An attacker can inject malicious JavaScript code into an HTTP request, which will be executed in the victim's browser.
Risk Assessment
The risk involves potential session theft, redirection to malicious sites, or other actions performed in the victim's session context, leading to confidentiality and integrity breaches within the organization.
Recommendation
Immediately update the RT-Theme 18 | Extensions plugin to a version higher than 2.5 if available, or apply temporary mitigations such as input/output filtering and implementing Content Security Policy (CSP) headers.
Other vulnerabilities in RT-Theme 18 | Extensions
See all- CVE-2026-57744Critical
The RT-Theme 18 | Extensions (rt18-extensions) plugin up to version 2.5 contains a deserialization of untrusted data vulnerability allowing object injection. An attacker can remotely exploit this flaw to execute arbitrary code or manipulate data.
- CVE-2026-57743High
The RT-Theme 18 | Extensions (rt18-extensions) plugin version 2.5 and earlier contains a PHP Local File Inclusion (LFI) vulnerability due to improper control of filename in include/require statement. This allows an attacker to include arbitrary files from the server.
- CVE-2026-39711Medium
The RT-Theme 18 | Extensions plugin for WordPress up to version 2.5 inserts sensitive data into sent information. Attackers can retrieve embedded sensitive data.
- CVE-2026-39710Medium
CSRF vulnerability in RT-Theme 18 | Extensions (rt18-extensions) up to version 2.5 inclusive. Allows Cross-Site Request Forgery.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows Reflected XSS.This issue affects RT-Theme 18 | Extensions: from n/a through <= 2.5.