ThemeStek Extras CVE-2026-94160

Exploitation requires an attacker to deliver a crafted URL (with a payload reflected by the plugin's input handling) and have a victim user actively click it - this user-interaction requirement (CVSS UI:R) is the primary limiting factor, as the attack cannot self-propagate or fire without victim engagement. No authentication is required of the attacker (PR:N), and it works against affected installations of the ThemeStek Extras for LabtechCO Theme plugin (versions through 8.4), but the site must have this specific plugin installed and active, which narrows the exposed population. Because the flaw is reflected (non-persistent), the payload is not stored and each exploitation needs a fresh lure, further constraining real-world impact.

This is a reflected cross-site scripting (CWE-79) flaw rated CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), with the scope change and triple low impacts inflating the base score above what the real-world threat typically warrants for reflected XSS. The CVSS signals network vector, low complexity, and no required privileges, but the mandatory user interaction (UI:R) is the key limiting factor: an attacker cannot exploit this autonomously and must socially engineer a logged-in or targeted victim into clicking a crafted link. No EPSS score, SSVC decision data, KEV listing, or POC indicator was supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active or automatable exploitation. The practical risk is moderate-to-low: reflected XSS is non-persistent and one-click-dependent, and the affected software is a niche add-on, so this should be patched on a normal cadence rather than treated as an emergency. Note the scope-change/impact-driven 7.1 may overstate urgency relative to the UI:R constraint - defenders should weight the user-interaction requirement heavily.

An attacker crafts a malicious URL containing a script payload that is reflected unsanitized into a page generated by the ThemeStek Extras for LabtechCO Theme plugin, then lures a WordPress site visitor or administrator into clicking it (e.g., via phishing). When the victim loads the link, the injected JavaScript executes in their browser session in the context of the vulnerable site, potentially enabling session/cookie theft or actions on behalf of the victim. No public exploit code was identified in the provided data, and successful exploitation hinges on the victim interacting with the attacker-supplied link.