Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows Reflected XSS.This issue affects RT-Theme 18 | Extensions: from n/a through <= 2.5.
Published: 2026-07-13
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The RT‑Theme 18 | Extensions plugin for WordPress contains an improper neutralization of input during web page generation, which allows a reflected Cross‑Site Scripting flaw. The flaw permits arbitrary JavaScript to execute in the context of a victim’s browser when a crafted request is reflected back in a page.

Affected Systems

WordPress sites that have installed the RT‑Theme 18 | Extensions plugin from stmcan, in any version up to and including 2.5, are affected.

Risk and Exploitability

The CVSS score of 7.1 indicates high severity, while the EPSS score of less than 1 % points to a low likelihood of exploitation as of now. The flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that the vulnerability can be triggered by a user visiting a maliciously crafted URL, without requiring authentication.

Generated by OpenCVE AI on August 1, 2026 at 10:33 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the RT‑Theme 18 | Extensions plugin to the latest available version.
  • If an upgrade is not immediately possible, sanitize user‑supplied input or encode output to mitigate the reflected XSS flaw.
  • Configure a Content Security Policy that disallows or restricts inline script execution to reduce the impact of any reflected XSS.

Generated by OpenCVE AI on August 1, 2026 at 10:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 13 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 13 Jul 2026 14:00:00 +0000

Type Values Removed Values Added
First Time appeared Stmcan
Stmcan rt-theme 18 | Extensions
Wordpress
Wordpress wordpress
Vendors & Products Stmcan
Stmcan rt-theme 18 | Extensions
Wordpress
Wordpress wordpress

Mon, 13 Jul 2026 10:00:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows Reflected XSS.This issue affects RT-Theme 18 | Extensions: from n/a through <= 2.5.
Title WordPress RT-Theme 18 | Extensions plugin <= 2.5 - Reflected Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

Stmcan Rt-theme 18 | Extensions
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-07-13T13:53:26.976Z

Reserved: 2026-06-25T08:04:29.579Z

Link: CVE-2026-57745

cve-icon Vulnrichment

Updated: 2026-07-13T13:53:23.673Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-01T10:45:03Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')