EUVD-2026-43388Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Reflected XSS is network-reachable and low-complexity with no attacker auth (PR:N) but needs victim click (UI:R); scope changes into browser context (S:C) with limited C/I/A impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows Reflected XSS.This issue affects RT-Theme 18 | Extensions: from n/a through <= 2.5.
AnalysisAI
Reflected cross-site scripting in the stmcan RT-Theme 18 | Extensions WordPress plugin (all versions up to and including 2.5) lets remote attackers inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. Because the CVSS scope is changed (S:C), a successful payload can affect resources beyond the vulnerable component, such as the WordPress session context. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; disclosure comes from Patchstack.
Technical ContextAI
The affected component is rt18-extensions, the companion extensions plugin for the commercial RT-Theme 18 WordPress theme by stmcan, identified by CPE cpe:2.3:a:stmcan:rt-theme_18_|_extensions. The root cause is CWE-79, Improper Neutralization of Input During Web Page Generation: user-controllable request input is reflected back into an HTML response without adequate output encoding or input sanitization, so a browser interprets attacker-supplied markup as executable script. As a reflected variant, the payload is not stored server-side but is delivered within the request itself (typically a URL parameter) and echoed into the generated page, meaning exploitation requires the victim to load an attacker-crafted request.
RemediationAI
No vendor-released patch version is identified in the available data (the advisory documents affected versions up to and including 2.5 without naming a fixed build), so administrators should monitor the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/rt18-extensions/vulnerability/wordpress-rt-theme-18-extensions-plugin-2-5-reflected-cross-site-scripting-xss-vulnerability and the stmcan/RT-Theme 18 vendor channel for an update newer than 2.5 and apply it as the primary fix. As compensating controls until a patch is available, deploy a WordPress-aware WAF or the Patchstack virtual-patch rule to filter the reflected XSS payload (trade-off: possible false positives on legitimate parameter values), enforce a strict Content-Security-Policy that disallows inline script execution to blunt reflected payloads (trade-off: may break theme features that rely on inline scripts), and consider disabling or restricting access to the affected extensions endpoint if the feature is not in use. These reduce exposure but do not remove the underlying flaw.
More in Rt Theme 18 Extensions
View allPHP Object Injection in the RT-Theme 18 | Extensions plugin (rt18-extensions) for WordPress affects all versions up to a
PHP Local File Inclusion in the WordPress RT-Theme 18 | Extensions plugin (rt18-extensions) by stmcan lets remote attack
Cross-site request forgery (CSRF) in stmcan RT-Theme 18 Extensions plugin version 2.5 and earlier allows unauthenticated
RT-Theme 18 Extensions WordPress plugin versions up to 2.5 exposes sensitive data through insertion of information into
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today