The vulnerability identified as CVE-2026-57745 affects the stmcan RT-Theme 18 | Extensions product, specifically versions up to and including 2.5. It is a reflected cross-site scripting (XSS) flaw caused by improper neutralization of input during web page generation. This allows attackers to inject malicious scripts that execute in the context of the victim's browser session. The CVSS 3.1 base score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and no exploits have been reported in the wild.

Successful exploitation of this reflected XSS vulnerability could allow an attacker to execute arbitrary scripts in the victim's browser, potentially leading to information disclosure, session hijacking, or other impacts on confidentiality, integrity, and availability as indicated by the CVSS vector. The vulnerability affects all users who interact with the vulnerable web pages and can be triggered remotely without authentication but requires user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying web application firewall (WAF) rules to detect and block reflected XSS attempts and educate users to avoid clicking suspicious links. Monitor vendor channels for updates and patches addressing this vulnerability.