The vulnerability resides in the ThemeREX Addons plugin’s SVG rendering routine, where the trx_addons_get_svg_from_file() function accepts an unvalidated 'svg' parameter from shortcode or Elementor widget settings and outputs it through trx_addons_show_layout() without sanitizing the URL or its contents. Because no origin or scheme checks are performed, a contributor or higher user can supply a remote SVG containing malicious scripts. When a user views the affected page, the included JavaScript executes in that user’s browser, potentially allowing an attacker to steal session cookies, deface content, or perform other client‑side attacks. The primary impact is arbitrary JavaScript execution in the context of the visiting user, which can lead to loss of confidentiality, integrity, and availability of the site’s content.

WordPress sites that have installed the ThemeREX Addons plugin with a version of 2.35.1.1 or earlier. The affected product is the ThemeREX Addons plugin distributed by ThemeREX for WordPress. No specific WordPress core version is required for the flaw to exist; any site that uses the vulnerable plugin version is at risk.

The flaw has a CVSS score of 6.4, indicating a medium severity vulnerability. The EPSS score is reported as < 1%, suggesting low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers must first be authenticated with the Contributor role or higher, and then independently supply a crafted SVG file via the shortcode or Elementor widget. Once executed, the malicious script runs in the context of any user who views the page, creating a convenience vulnerability that does not require privilege escalation beyond a legitimate Contributor level. The risk is elevated for sites that grant Contributor access to many users, or that have a large and diverse user base that includes guests who will view the injected content. Overall, while exploitation likelihood is currently low, the impact warrants prompt mitigation.