The vulnerability is a stored or reflected XSS flaw that does not require authentication. An attacker can inject malicious script into plugin configuration or displayed content, enabling the execution of arbitrary client‑side code in the context of the site’s users. The impact includes theft of credentials, session hijacking, defacement, or delivery of malware.

WordPress sites using the ThemeREX Addons plugin versions earlier than 2.45.0 are susceptible. The affected product is the ThemeREX Addons plugin distributed by ThemeRex.

The CVSS score of 7.1 indicates a high severity weakness. Splitting the risk analysis, the absence of an EPSS score suggests no recent public exploitation, but the lack of authentication requirement means any user visiting the site could be compromised. The vulnerability is not listed in CISA KEV, so public exploitation is not known as of the last update. Attackers would craft a payload and embed it in application input that is rendered without proper escaping, then entice or force victims to view the page. The attack can be carried out from any remote location with internet access.