CVE-2026-97236 in ThemeREX Addons Plugin
Summary
by MITRE • 09/30/2026
Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified as a Subscriber Cross-Site Scripting issue within ThemeREX Addons prior to version 2.45.0 represents a significant security flaw affecting WordPress-based websites that utilize this plugin suite. This specific class of vulnerability allows authenticated users with subscriber-level privileges, which are typically the lowest level of access in standard WordPress installations, to inject malicious client-side scripts into web pages viewed by other users or even themselves. The core technical failure lies in insufficient input validation and output encoding mechanisms within the plugin's handling of user-generated content. When a subscriber submits data through various forms or profile settings managed by ThemeREX Addons, the application fails to properly sanitize this input before storing it or rendering it back into the browser environment without adequate escaping. This oversight permits the injection of JavaScript code that executes in the context of the victim's session when they interact with the affected page elements.
From a technical perspective, this flaw aligns closely with CWE-79, which categorizes improper neutralization of input during web page generation known as Cross-Site Scripting. The attack vector typically involves an attacker crafting a payload containing malicious JavaScript, often embedded within HTML attributes or script tags, and submitting it through any accessible form field in the plugin that lacks robust sanitization filters. Because the vulnerability is triggered by subscriber-level accounts, it highlights a critical failure in privilege separation and input validation logic. In many web applications, lower-privilege users are expected to have restricted capabilities, but this flaw demonstrates that even basic user inputs can be exploited to execute arbitrary code if the backend processing does not enforce strict content security policies or apply context-aware encoding before rendering data into HTML structures.
The operational impact of this vulnerability is substantial due to its potential for session hijacking and credential theft. An attacker who successfully exploits this XSS flaw can steal sensitive information such as authentication cookies, session tokens, or personal user details displayed on the page. By injecting a script that exfiltrates these values to an external server controlled by the attacker, they can impersonate legitimate users without needing their passwords. Furthermore, the vulnerability enables phishing attacks where the injected script manipulates the DOM to display fake login forms or redirect users to malicious sites designed to harvest credentials. In some scenarios, if combined with other vulnerabilities like Cross-Site Request Forgery, it could allow for further actions on behalf of the victim, such as changing account settings or performing administrative tasks if higher privileges are somehow exposed through UI manipulation.
This incident is also relevant to MITRE ATT&CK framework techniques related to Client-Side Injection and Collection via Browser Redirects or Screen Capture depending on the specific payload used. The ability for low-privilege users to execute code underscores a broader architectural weakness in how third-party plugins handle user input within the WordPress ecosystem, where many extensions assume that only administrators pose a threat while neglecting risks from lower-tier accounts. To mitigate this risk, immediate updates to ThemeREX Addons version 2.45.0 or later are required as these versions include patches for proper input sanitization and output encoding. Administrators should ensure that all plugins are kept up-to-date with the latest security releases provided by their developers. Additionally, implementing a Content Security Policy header can help mitigate the impact of any remaining XSS vulnerabilities by restricting the sources from which scripts can be loaded or executed. Regular auditing of plugin code for proper use of WordPress sanitization functions such as sanitize_text_field and esc_html is also recommended to prevent similar issues in future updates.