Skip to content
OpenAdvisories

Vendor

ThemeREX

236 known vulnerabilities.

ThemeREX at a glance

Last 12 months
227
Critical · all time
71
Exploited · all time
0
Public exploit · all time
1
New vulnerabilities per month · last 12 months
0 100 200 December 2025: 0 vulnerabilities Dec 2025 January 2026: 2 vulnerabilities, 1 critical February 2026: 10 vulnerabilities, 2 critical March 2026: 105 vulnerabilities, 13 critical Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 57 vulnerabilities, 4 critical Jun July 2026: 2 vulnerabilities August 2026: 1 vulnerability, 1 critical September 2026: 3 vulnerabilities, 1 critical Sep October 2026: 47 vulnerabilities, 45 critical November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 20264745
Sep 202631
Aug 202611
Jul 202620
Jun 2026574
May 202600
Apr 202600
Mar 202610513
Feb 2026102
Jan 202621
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202511
Jul 202521
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202530
Jan 202521
Dec 202400

Products

ThemeREX Addons 6 Puzzles | WP Magazine / Review with Store WordPress Theme + RTL 3 Tipsy 2 ShiftCV 2 Ozisti 2 Filmax 2 Education Center 2 Preservation 2 Motorix 2 Marcell 2 Muzicon 2 Invetex 2 Asia Garden 2 Booked 2 Law Office 2 RexCoin 2 EmojiNation 2 Stargaze 2 N7 | Golf Club Sports & Events 2 Le Truffe 2 Bonbon 2 Coinpress 2 Edge Decor 2 Yacht Rental 2 Splendour 2 Gunslinger 2 Windsor 2 Nuts 2 Gamezone 2 Gamic 2 Printy 2 Avventure 2 Meals & Wheels 2 WineShop 2 Alliance 2 Quirky 2 Legal Stone 2 Orpheus 2 Mission 2 Equadio 2
All Critical High Medium Low Exploited only Public exploit

236 results · Feed

  • Critical 9.8
    CVE-2026-119526

    WordPress Royal Event theme <= 2.0 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection. This issue affects Royal Event: from n/a through 2.0.

    ThemeREX Royal Event
  • Critical 9.8
    CVE-2026-62018

    WordPress Gunslinger theme <= 1.11 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.

    ThemeREX Gunslinger
  • Critical 9.8
    CVE-2026-62017

    WordPress Good Homes theme <= 1.3.13 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.

    ThemeREX Good Homes
  • Critical 9.8
    CVE-2026-62016

    WordPress Gamic theme <= 1.19 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.

    ThemeREX Gamic
  • Critical 9.8
    CVE-2026-62015

    WordPress Gamezone theme <= 1.1.11 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.

    ThemeREX Gamezone
  • Critical 9.8
    CVE-2026-62014

    WordPress EmojiNation theme <= 1.0.12 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions.

    ThemeREX EmojiNation
  • Critical 9.8
    CVE-2026-62013

    WordPress Edge Decor theme <= 2.9 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions.

    ThemeREX Edge Decor Browsers
  • Critical 9.8
    CVE-2026-62012

    WordPress Coinpress theme <= 1.0.15 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions.

    ThemeREX Coinpress
  • Critical 9.8
    CVE-2026-62010

    WordPress Avventure theme <= 1.1.12 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions.

    ThemeREX Avventure
  • Critical 9.8
    CVE-2026-62011

    WordPress Bonbon theme <= 1.11 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions.

    ThemeREX Bonbon
  • Critical 9.8
    CVE-2026-62009

    WordPress Filmax theme <= 1.1.11 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions.

    ThemeREX Filmax
  • Critical 9.8
    CVE-2026-62008

    WordPress Orpheus theme <= 1.8 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.

    ThemeREX Orpheus
  • Critical 9.8
    CVE-2026-62006

    WordPress Nuts theme <= 1.12 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Nuts <= 1.12 versions.

    ThemeREX Nuts
  • Critical 9.8
    CVE-2026-62005

    WordPress Muzicon theme <= 1.15 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.

    ThemeREX Muzicon
  • Critical 9.8
    CVE-2026-62004

    WordPress Motorix theme <= 1.11 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Motorix <= 1.11 versions.

    ThemeREX Motorix
  • Critical 9.8
    CVE-2026-62003

    WordPress Mission theme <= 1.22 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Mission <= 1.22 versions.

    ThemeREX Mission
  • Critical 9.8
    CVE-2026-62002

    WordPress Meals & Wheels theme <= 1.1.13 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions.

    ThemeREX Meals & Wheels
  • Critical 9.8
    CVE-2026-62001

    WordPress Marcell theme <= 1.2.14 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.

    ThemeREX Marcell
  • Critical 9.8
    CVE-2026-61998

    WordPress Le Truffe theme <= 1.1.7 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions.

    ThemeREX Le Truffe
  • Critical 9.8
    CVE-2026-61997

    WordPress Legal Stone theme <= 1.2.11 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions.

    ThemeREX Legal Stone
  • Critical 9.8
    CVE-2026-54860

    WordPress Ozisti theme <= 1.1.10 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions.

    ThemeREX Ozisti
  • Critical 9.8
    CVE-2026-54859

    WordPress Preservation theme <= 1.15 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Preservation <= 1.15 versions.

    ThemeREX Preservation
  • Critical 9.8
    CVE-2026-54858

    WordPress Printy theme <= 1.13.0 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions.

    ThemeREX Printy
  • Critical 9.8
    CVE-2026-54856

    WordPress RexCoin theme <= 1.2.6 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions.

    ThemeREX RexCoin
  • Critical 9.8
    CVE-2026-54857

    WordPress Quirky theme <= 1.23 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Quirky <= 1.23 versions.

    ThemeREX Quirky
  • Critical 9.8
    CVE-2026-112847

    WordPress ZenSoul theme <= 1.13 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue affects ZenSoul: from n/a through 1.13.

    ThemeREX ZenSoul
  • Critical 9.8
    CVE-2026-81797

    WordPress Buzz Stone | Magazine & Viral Blog WordPress Theme theme <= 1.0.2 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions.

    ThemeREX Buzz Stone | Magazine & Viral Blog WordPress Theme Web / CMS
  • Critical 9.8
    CVE-2026-78535

    WordPress Photolia theme <= 1.0.3 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.

    ThemeREX Photolia
  • Critical 9.8
    CVE-2026-78531

    WordPress Jacqueline theme <= 2.22 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.

    ThemeREX Jacqueline
  • Critical 9.8
    CVE-2026-78529

    WordPress Alliance theme <= 3.11 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.

    ThemeREX Alliance
  • Critical 9.8
    CVE-2026-66564

    WordPress ShiftCV theme <= 3.0.14 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.

    ThemeREX ShiftCV
  • Critical 9.8
    CVE-2026-66563

    WordPress Windsor theme <= 2.10 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.

    ThemeREX Windsor
  • Critical 9.8
    CVE-2026-66483

    WordPress Education Center theme <= 3.6.12 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions.

    ThemeREX Education Center
  • Critical 9.8
    CVE-2026-62125

    WordPress Asia Garden theme <= 1.3.1 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions.

    ThemeREX Asia Garden
  • Critical 9.8
    CVE-2026-62123

    WordPress Invetex theme <= 2.18 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Invetex <= 2.18 versions.

    ThemeREX Invetex
  • Critical 9.8
    CVE-2026-62124

    WordPress N7 | Golf Club Sports & Events theme <= 2.21 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions.

    ThemeREX N7 | Golf Club Sports & Events
  • Critical 9.8
    CVE-2026-62120

    WordPress Law Office theme <= 3.20 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Law Office <= 3.20 versions.

    ThemeREX Law Office
  • Critical 9.8
    CVE-2026-62090

    WordPress WineShop theme <= 3.20 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in WineShop <= 3.20 versions.

    ThemeREX WineShop
  • Critical 9.8
    CVE-2026-62087

    WordPress Equadio theme <= 1.1.4 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions.

    ThemeREX Equadio
  • Critical 9.8
    CVE-2026-62086

    WordPress Juno theme <= 2.25 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Juno <= 2.25 versions.

    ThemeREX Juno