Is CVE-2026-102798 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-102798 being exploited in the wild.

How severe is CVE-2026-102798?

Medium severity, with a CVSS score of 6.5, published 2 October 2026.

Which products and versions are affected?

ThemeREX Group ThemeREX Addons through 2.46.0.

Is there a fix for CVE-2026-102798?

Yes: fixed in 2.47.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-102798 attacked?

It is attacked over the network.

Am I affected by CVE-2026-102798?

Check whether you run ThemeREX Group ThemeREX Addons at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102798: ThemeREX Addons stored cross-site scripting

CVE-2026-102798 · Severity: medium · CVSS 6.5 · Published 2026-10-02

ThemeREX Addons is a WordPress plugin that extends website functionality with additional features and design elements. A stored XSS vulnerability allows attackers with contributor-level access to inject malicious scripts into the site that persist and execute when other users view the affected pages, potentially stealing visitor data or hijacking accounts.

Vendors: ThemeREX Group.

Quick answers

Is CVE-2026-102798 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-102798 being exploited in the wild.
How severe is CVE-2026-102798?: Medium severity, with a CVSS score of 6.5, published 2 October 2026.
Which products and versions are affected?: ThemeREX Group ThemeREX Addons through 2.46.0.
Is there a fix for CVE-2026-102798?: Yes: fixed in 2.47.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-102798 attacked?: It is attacked over the network.
Am I affected by CVE-2026-102798?: Check whether you run ThemeREX Group ThemeREX Addons at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.47.0

Technical details

The plugin fails to properly sanitize user input during web page generation, allowing stored cross-site scripting (XSS) injection. The vulnerability requires contributor-level privileges and user interaction (visiting a crafted page or clicking a malicious link) to exploit. An authenticated attacker can inject persistent scripts that execute in the browsers of site visitors.

Affected products

ThemeREX Group ThemeREX Addons through 2.46.0

Timeline

2026-10-02: disclosed
2026-10-02: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.