CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

4 matches found

patchstack•added 2025/07/21 1:45 a.m.•9 views

WordPress ThemeREX Addons plugin <= 2.35.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via trx_addons_get_svg_from_file Function vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via trxaddonsgetsvgfromfile Function vulnerability discovered by stealthcopter in WordPress Plugin ThemeREX Addons versions = 2.35.1.1...

6.4CVSS5.5AI score0.00205EPSS

Exploits0References1Affected Software1

cve•added 2025/07/19 8:24 a.m.•31 views

CVE-2025-6997

CVE-2025-6997 : ThemeREX Addons for WordPress is vulnerable to a stored cross-site scripting (XSS) via SVG uploads in versions

6.4CVSS5.8AI score0.00205EPSS

Exploits0References2Affected Software1

cvelist•added 2025/07/19 8:24 a.m.•13 views

CVE-2025-6997 ThemeREX Addons <= 2.35.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via trx_addons_get_svg_from_file Function

The ThemeREX Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.35.1.1 due to insufficient input sanitization and output escaping. The plugin’s SVG rendering routine calls the trxaddonsgetsvgfromfile function on an...

6.4CVSS0.00205EPSS

Exploits0References2