Cross-site Scripting Vulnerability in ThemeStek Extras for LabtechCO Theme
CVE-2026-94160

7.1HIGH

Key Information:

Vendor

WordPress
Status
Themestek Extras For Labtechco Theme
Vendor
CVE Published:
10 October 2026

What is CVE-2026-94160?

The ThemeStek Extras for LabtechCO Theme contains a vulnerability that allows attackers to perform Reflected Cross-site Scripting (XSS). By improperly neutralizing input during web page generation, this security flaw can let malicious users inject harmful scripts that execute in the context of a victim’s web browser. This could lead to compromised user data and further malicious exploits. Users are advised to update to the latest version to protect against this vulnerability.

Affected Version(s)

ThemeStek Extras for LabtechCO Theme 0 <= 8.4

References

https://patchstack.com/database/wordpress/plugin/themeste...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

João Pedro S Alcântara (Kinorth) | Patchstack Bug Bounty Program
.