Description

Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-30T13:17:35.083Z",
  "pubdate": "2026-09-30T13:17:35.083Z",
  "executiveSummary": "The ThemeREX Addons plugin, in versions prior to 2.45.0, contains an unauthenticated Cross-Site Scripting (XSS) vulnerability.\nThis security flaw allows remote, unauthenticated attackers to inject malicious JavaScript into web pages viewed by other users, including administrators.\nThe impact includes potential session hijacking, unauthorized actions performed on behalf of legitimate users, and the defacement of the affected website.\nThe vulnerability originates from insufficient input sanitization of user-supplied data, which is subsequently reflected in the application's response without proper encoding.\nThe risk is considered critical for affected installations as no authentication is required to initiate an attack, lowering the barrier for exploitation by malicious actors.\nUsers of the ThemeREX Addons plugin are strongly advised to update to version 2.45.0 or higher to mitigate the risk of exploitation.",
  "technicalDetails": "The vulnerability is identified as a reflected or stored Cross-Site Scripting (XSS) flaw, stemming from the plugin's failure to properly sanitize and escape user-supplied inputs before rendering them in the Document Object Model (DOM).\nRoot Cause: The plugin components fail to validate input parameters or implement context-aware output encoding. When a malicious script is passed via a crafted request, the application reflects this input back to the browser, which then executes the payload within the security context of the user's session.\nAttack Flow: An attacker crafts a malicious URI or payload containing JavaScript. When a target user, such as an authenticated administrator, accesses the crafted URL or interacts with the compromised component, the browser parses the payload as legitimate script content. This bypasses client-side security controls due to the lack of Content Security Policy (CSP) enforcement or inadequate server-side filtering.\nAuthentication Requirements: This vulnerability is exploitable without authentication, meaning the attacker does not need prior access to the WordPress dashboard or specific user privileges to trigger the execution of the payload.\nPayload Behavior: The injected script can execute arbitrary commands in the victim's browser. This often includes stealing session cookies (e.g., PHPSESSID or WordPress authentication cookies), performing unauthorized administrative actions such as creating new rogue accounts, modifying plugin settings, or redirecting users to malicious external domains.\nAffected Versions: All versions of ThemeREX Addons strictly prior to 2.45.0 are susceptible. The flaw persists across these versions due to the lack of robust input handling libraries or global sanitization routines in the affected hooks or modules.\nNetwork Exposure: The vulnerability is accessible over the network via HTTP/HTTPS, making any publicly reachable website utilizing an unpatched version of the plugin a viable target for automated and targeted exploitation campaigns.\nPost-Exploitation Impact: Successful exploitation allows for complete takeover of a user session, potential elevation of privileges through unauthorized administrative actions, and significant risk to the integrity and confidentiality of the site content."
}