CVE-2026-97236
Received Received - Intake

Subscriber XSS in ThemeREX Addons

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: Patchstack

Description
Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-30
Last Modified
2026-09-30
Generated
2026-09-30
AI Q&A
2026-09-30
EPSS Evaluated
N/A
NVD
CVE-2026-97236
EUVD
EUVD-2026-89900

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
themerex addons to 2.45.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Subscriber Cross Site Scripting (XSS) vulnerability in the ThemeREX Addons plugin for WordPress, affecting versions below 2.45.0. It allows attackers to inject malicious scripts into websites by exploiting insufficient input sanitization. The vulnerability requires a privileged user to trigger it, such as clicking a malicious link or submitting a form.

Detection Guidance

Detecting this XSS vulnerability requires checking the installed version of the ThemeREX Addons plugin. Use WordPress admin dashboard to view the plugin version or run SQL queries on the database to check the version stored in the wp_options table. No specific commands are provided in the context for direct detection.

Impact Analysis

Attackers could steal visitor data, hijack user accounts, or perform unauthorized actions on the website. The impact is moderate but could affect thousands of websites if exploited in mass campaigns. Immediate mitigation is recommended by updating the plugin.

Mitigation Strategies

Immediately update the ThemeREX Addons plugin to version 2.45.0 or later. If updating is not possible, apply the mitigation rule provided by Patchstack to block attacks until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97236. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart