Description

Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-30T13:17:35.227Z",
  "pubdate": "2026-09-30T13:17:35.227Z",
  "executiveSummary": "ThemeREX Addons versions prior to 2.45.0 are susceptible to a Stored Cross-Site Scripting (XSS) vulnerability.\nThe vulnerability originates from inadequate input sanitization and output escaping within the plugin's configuration or add-on handling mechanisms.\nSuccessful exploitation allows authenticated users, such as those with Subscriber-level privileges, to inject arbitrary JavaScript into the application context.\nWhen a victim with higher privileges (such as an Administrator) views the affected component, the malicious payload executes within their browser session.\nThis can lead to unauthorized actions performed on behalf of the administrator, theft of session cookies, or further compromise of the WordPress environment.\nThe vulnerability represents a significant risk to site integrity and administrative control, necessitating immediate remediation via plugin update.",
  "technicalDetails": "The vulnerability exists in ThemeREX Addons versions < 2.45.0 due to improper handling of user-supplied data that is subsequently rendered in the administrative dashboard.\nThe root cause is a failure to implement robust input validation or context-aware output encoding on parameters processed by the plugin's add-on framework.\nBy design, the plugin allows users to interact with specific settings; however, these interfaces lack strict attribute-based filtering, enabling the injection of script tags or malicious event handlers into persistent storage (e.g., WordPress options or post meta).\nThe attack flow commences with a Subscriber-level user authenticating to the WordPress site. The attacker identifies an input field or parameter within the ThemeREX Addons configuration that does not restrict the input of HTML or JavaScript tags.\nThe attacker submits a crafted payload containing malicious script, such as '<script>alert(document.cookie)</script>', into the vulnerable input field. The plugin processes this request and stores the malicious string in the database without sanitization.\nThe exploitation is triggered when an administrative user accesses the backend page where the stored, malicious content is retrieved and outputted directly into the DOM.\nBecause the output is rendered without proper sanitization (e.g., using esc_html() or esc_js() functions), the browser interprets the injected string as active content.\nThe payload executes in the security context of the administrative user, granting the attacker the ability to perform any action the administrator is permitted to conduct.\nPotential post-exploitation activities include creating new administrative accounts, modifying site settings, redirecting traffic, or injecting persistent backdoors via theme or plugin editors if accessible.\nThe vulnerability is restricted to authenticated users but requires no specific administrative capability beyond basic Subscriber status, significantly lowering the barrier for exploitation within the WordPress ecosystem."
}