CVE-2026-94160: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in themeStek ThemeStek Extras for LabtechCO Theme

The vulnerability CVE-2026-94160 in ThemeStek Extras for LabtechCO Theme is caused by improper neutralization of input during web page generation, leading to reflected cross-site scripting (XSS). This flaw allows attackers to inject and execute malicious scripts in the context of the victim's browser when they interact with crafted web content. The affected versions include all releases from 0 through 8.4. The CVSS 3.1 vector indicates the vulnerability can be exploited remotely without privileges but requires user interaction. The impact includes partial loss of confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the victim's browser, potentially leading to theft of sensitive information, session hijacking, or disruption of service. The reflected XSS nature means the attack requires the victim to interact with a crafted link or web page. The overall impact is rated high due to the combination of confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, users should exercise caution with untrusted input and avoid interacting with suspicious links related to the affected product.