CVE Catalog
CVE-2026-97235
HighCVSS 7.1Summary
Unauthenticated XSS attack in ThemeREX Addons plugin versions prior to 2.45.0. An attacker can inject malicious script without authentication.
Risk Assessment
Risk of session hijacking, admin account takeover, or malware distribution on the site.
Recommendation
Update the ThemeREX Addons plugin to version 2.45.0 or later.
Other vulnerabilities in ThemeREX Addons
See all- CVE-2026-97236Medium
Cross Site Scripting (XSS) vulnerability in ThemeREX Addons before version 2.45.0. A subscriber can inject malicious scripts.
- CVE-2026-62105Critical
Unauthenticated PHP Object Injection in ThemeREX Addons versions below 2.45.0.
- CVE-2025-60205Critical
There is an unauthenticated PHP Object Injection vulnerability in ThemeREX Addons versions <= 2.36.1.1.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS