addons vulnerabilities
CVEs whose affected-version data names the addons package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-97235High· 7.1Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.
Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.
▾ TwilightThemeRex · ThemeREX AddonsEPSS 0.18%via NVD
CVE-2026-97236Medium· 6.5Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.
Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.
▾ SunlitThemeRex · ThemeREX AddonsEPSS 0.21%via NVD
CVE-2026-62105Critical· 9.8Unauthenticated PHP Object Injection in ThemeREX Addons < 2.45.0 versions.
Unauthenticated PHP Object Injection in ThemeREX Addons < 2.45.0 versions.
▾ MidnightThemeRex · ThemeREX AddonsEPSS 0.56%via NVD