Themerex Addons
Monthly
Reflected cross-site scripting in the ThemeREX Addons WordPress plugin affects all versions below 2.45.0, allowing an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser within the affected site's origin. Exploitation requires user interaction (CVSS vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base score 7.1): the attacker must lure a victim to a crafted link or attacker-influenced page that triggers the injected payload, and success also depends on the site lacking a WAF or the patched plugin. There is no public exploit code identified at time of analysis and no confirmed active exploitation; impact is confined to the victim's browser session (low confidentiality, integrity and availability) rather than direct server compromise.
Unauthenticated PHP Object Injection in the ThemeREX Addons (trx_addons) WordPress plugin before 2.45.0 lets remote attackers inject arbitrary serialized PHP objects into the application. Because no authentication is required (CVSS 9.8, PR:N/UI:N), an attacker can supply crafted serialized data to a vulnerable entry point; when combined with a suitable POP gadget chain present in the plugin, another plugin, a theme, or WordPress core, this can escalate to code execution, arbitrary file operations, or data compromise. Reported by Patchstack; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authenticated server-side request forgery (SSRF) in ThemeREX Addons versions up to 2.46.0 allows any logged-in WordPress user with low privileges to force the server to make arbitrary HTTP requests, potentially reaching internal services or cloud metadata endpoints. The CVSS 6.4 rating reflects limited confidentiality and integrity impact, and exploitation requires the plugin to be active and an attacker to hold a valid low-privilege account. No public exploit identified at time of analysis.
Stored cross-site scripting (XSS) in the ThemeREX Addons WordPress plugin, affecting all versions through 2.46.0, allows an authenticated attacker with at least low-level posting privileges to inject malicious JavaScript that executes in the browser of a privileged user who views the compromised page. The vulnerability has a CVSS 3.1 base score of 6.5 and requires victim interaction; no public exploit code or active exploitation has been identified at the time of analysis. Impact is limited to browser-context script execution and does not result in server-side compromise.
Cross-site scripting in ThemeREX Addons (the trx_addons WordPress plugin) below version 2.45.0 lets an authenticated attacker with only a Subscriber-level account inject script content that executes in the browser of any higher-privileged user who views it, enabling session theft or actions performed in the victim's context. Reaching the vulnerable input requires a Subscriber account - trivially obtainable when open WordPress registration is enabled - and successful exploitation is further gated by victim interaction, so an unauthenticated remote attacker cannot exploit a hardened site with registration disabled. No public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated PHP object injection in the ThemeREX Addons WordPress plugin (versions 2.36.1.1 and earlier) allows remote attackers to inject crafted serialized objects that are deserialized by the plugin, potentially leading to remote code execution, arbitrary file operations, or full site compromise when a suitable PHP gadget chain is present. The flaw is reachable without authentication and scores CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the CVE is not currently listed in CISA KEV.
Reflected cross-site scripting in the ThemeREX Addons WordPress plugin affects all versions below 2.45.0, allowing an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser within the affected site's origin. Exploitation requires user interaction (CVSS vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base score 7.1): the attacker must lure a victim to a crafted link or attacker-influenced page that triggers the injected payload, and success also depends on the site lacking a WAF or the patched plugin. There is no public exploit code identified at time of analysis and no confirmed active exploitation; impact is confined to the victim's browser session (low confidentiality, integrity and availability) rather than direct server compromise.
Unauthenticated PHP Object Injection in the ThemeREX Addons (trx_addons) WordPress plugin before 2.45.0 lets remote attackers inject arbitrary serialized PHP objects into the application. Because no authentication is required (CVSS 9.8, PR:N/UI:N), an attacker can supply crafted serialized data to a vulnerable entry point; when combined with a suitable POP gadget chain present in the plugin, another plugin, a theme, or WordPress core, this can escalate to code execution, arbitrary file operations, or data compromise. Reported by Patchstack; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authenticated server-side request forgery (SSRF) in ThemeREX Addons versions up to 2.46.0 allows any logged-in WordPress user with low privileges to force the server to make arbitrary HTTP requests, potentially reaching internal services or cloud metadata endpoints. The CVSS 6.4 rating reflects limited confidentiality and integrity impact, and exploitation requires the plugin to be active and an attacker to hold a valid low-privilege account. No public exploit identified at time of analysis.
Stored cross-site scripting (XSS) in the ThemeREX Addons WordPress plugin, affecting all versions through 2.46.0, allows an authenticated attacker with at least low-level posting privileges to inject malicious JavaScript that executes in the browser of a privileged user who views the compromised page. The vulnerability has a CVSS 3.1 base score of 6.5 and requires victim interaction; no public exploit code or active exploitation has been identified at the time of analysis. Impact is limited to browser-context script execution and does not result in server-side compromise.
Cross-site scripting in ThemeREX Addons (the trx_addons WordPress plugin) below version 2.45.0 lets an authenticated attacker with only a Subscriber-level account inject script content that executes in the browser of any higher-privileged user who views it, enabling session theft or actions performed in the victim's context. Reaching the vulnerable input requires a Subscriber account - trivially obtainable when open WordPress registration is enabled - and successful exploitation is further gated by victim interaction, so an unauthenticated remote attacker cannot exploit a hardened site with registration disabled. No public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated PHP object injection in the ThemeREX Addons WordPress plugin (versions 2.36.1.1 and earlier) allows remote attackers to inject crafted serialized objects that are deserialized by the plugin, potentially leading to remote code execution, arbitrary file operations, or full site compromise when a suitable PHP gadget chain is present. The flaw is reachable without authentication and scores CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the CVE is not currently listed in CISA KEV.