The vulnerability is an unauthenticated cross‑site scripting flaw that can be triggered within the ThemeREX Addons WordPress plugin by a subscriber user. An attacker can inject malicious JavaScript into the content rendered for a subscriber, which is then displayed to any visitor who views the affected page. This can lead to session hijacking, credential theft, or defacement of the site. The flaw resides in the input handling for subscriber data and is identified as CWE‑79.

WordPress sites that use the ThemeREX Addons plugin version 2.44.9 or earlier. The affected product is the ThemeREX Addons plugin as distributed by ThemeRex; only versions older than 2.45.0 are vulnerable.

The CVSS score of 6.5 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that exploitation is not currently observed at a large scale. The attack vector is likely local to the publisher’s subscriber interface; however, because subscriber content is publicly viewable, a malicious script could affect any visitor who views the affected page. The flaw requires no special system privileges and can be abused by any user who can create or edit subscriber content. In the absence of mitigations, all sites using the vulnerable plugin are exposed to the risk of cross‑site scripting.