Stored Cross-Site Scripting Vulnerability in ThemeREX Addons for WordPress

CVE-2025-6997

What is CVE-2025-6997?

The ThemeREX Addons plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability due to inadequate input validation and output handling of SVG file uploads. All versions up to and including 2.35.1.1 are impacted. Authenticated users with Contributor-level access or higher can exploit this weakness by uploading remote SVG files that contain malicious scripts. These scripts can execute when a user accesses the affected SVG file, posing a significant risk of unauthorized actions and data exposure.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References