This vulnerability (CVE-2026-97235) is classified as CWE-79, indicating improper neutralization of input leading to cross-site scripting (XSS). It affects ThemeREX Addons versions before 2.45.0. The flaw allows unauthenticated attackers to inject malicious scripts into web pages generated by the affected software. The CVSS 3.1 base score is 7.1, reflecting network attack vector, low attack complexity, no privileges required, requirement for user interaction, and impacts on confidentiality, integrity, and availability with a scope change.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected web application, potentially resulting in data disclosure, modification, or disruption of service. Because the vulnerability is unauthenticated and remotely exploitable, it poses a significant risk to users interacting with the affected web pages.

No explicit patch or remediation information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting access or applying workarounds recommended by the vendor if any.