CVE-2026-102798— WordPress ThemeREX Addons plugin <= 2.46.0 - Cross Site Scripting (XSS) vulnerability
Quick assessment
Affected
ThemeREX Group ThemeREX Addons
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
ThemeREX Group 的 ThemeREX Addons 插件（trx_addons）中存在网页生成期间输入中和不当的跨站脚本（XSS）漏洞，具体表现为存储型 XSS。该漏洞影响 ThemeREX Addons 的所有版本，从不存在限制（n/a）到 2.46.0 版本。
Possible ATT&CK Techniques 1 AI
T1059 · Command and Scripting InterpreterAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| ThemeREX Group | ThemeREX Addons | ≤ 2.46.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-102798
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WordPress ThemeREX Addons plugin <= 2.46.0 - Cross Site Scripting (XSS) vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Stored XSS.This issue affects ThemeREX Addons: from n/a through 2.46.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| ThemeREX Group | ThemeREX Addons | 0 ~ 2.46.0 | - |
|
II. Public POCs for CVE-2026-102798
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-102798
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-102798 (1)
IV. Related Vulnerabilities
Same product: ThemeREX Addons
-
CVE-2026-102797
WordPress ThemeREX Addons plugin <= 2.46.0 - Server Side Req -
CVE-2026-97236
WordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scrip -
CVE-2026-97235
WordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scrip -
CVE-2026-62105
WordPress ThemeREX Addons plugin < 2.45.0 - PHP Object Injec -
CVE-2025-60205
WordPress ThemeREX Addons plugin <= 2.36.1.1 - PHP Object In
Same vendor: ThemeREX Group
-
CVE-2026-102797
WordPress ThemeREX Addons plugin <= 2.46.0 - Server Side Req -
CVE-2026-39529
WordPress Elementra theme <= 1.0.9 - PHP Object Injection vu -
CVE-2025-60085
WordPress Learnify theme <= 1.15.0 - Local File Inclusion vu -
CVE-2025-58924
WordPress Geya theme <= 1.15 - Local File Inclusion vulnerab
Same weakness: CWE-79
-
CVE-2026-92767
Twenty20 Image Before-After <= 2.0.5 - Authenticated (Contri -
CVE-2026-104313
WPC Estimated Delivery Date for WooCommerce <= 4.0.1 - Refle -
CVE-2026-93889
Mail logging <= 2.1.12 - Unauthenticated Stored Cross-Site S -
CVE-2026-93896
WPFront Notification Bar <= 3.5.1 - Reflected Cross-Site Scr -
CVE-2026-92974
Photo Gallery by 10Web <= 1.8.46 - Reflected Cross-Site Scri
V. Comments for CVE-2026-102798
No comments yet