Skip to content
OpenAdvisories

Vendor

ThemeREX

266 known vulnerabilities.

Products

ThemeREX Addons 9 Puzzles | WP Magazine / Review with Store WordPress Theme + RTL 3 Tipsy 2 ShiftCV 2 Save Life 2 Ozisti 2 Filmax 2 Education Center 2 Preservation 2 Motorix 2 Marcell 2 Muzicon 2 Invetex 2 Asia Garden 2 Booked 2 Law Office 2 RexCoin 2 EmojiNation 2 Stargaze 2 N7 | Golf Club Sports & Events 2 FreightCo 2 Le Truffe 2 Bonbon 2 Coinpress 2 Edge Decor 2 Yacht Rental 2 Splendour 2 Gunslinger 2 Windsor 2 Nuts 2 Gamezone 2 Gamic 2 Printy 2 Avventure 2 Meals & Wheels 2 WineShop 2 Alliance 2 Quirky 2 Legal Stone 2 Orpheus 2
All Critical High Medium Low Exploited only Public exploit

95 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-62120

    WordPress Law Office theme <= 3.20 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Law Office <= 3.20 versions.

    ThemeREX Law Office
  • Critical 9.8
    CVE-2026-62090

    WordPress WineShop theme <= 3.20 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in WineShop <= 3.20 versions.

    ThemeREX WineShop
  • Critical 9.8
    CVE-2026-62087

    WordPress Equadio theme <= 1.1.4 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions.

    ThemeREX Equadio
  • Critical 9.8
    CVE-2026-62086

    WordPress Juno theme <= 2.25 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Juno <= 2.25 versions.

    ThemeREX Juno
  • Critical 9.8
    CVE-2026-62054

    WordPress Yacht Rental theme <= 2.6 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions.

    ThemeREX Yacht Rental
  • Critical 9.8
    CVE-2026-62053

    WordPress Wine House theme <= 3.20 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Wine House <= 3.20 versions.

    ThemeREX Wine House
  • Critical 9.8
    CVE-2026-62052

    WordPress Tipsy theme <= 1.6 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions.

    ThemeREX Tipsy
  • Critical 9.8
    CVE-2026-62051

    WordPress Stargaze theme <= 1.10 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions.

    ThemeREX Stargaze
  • Critical 9.8
    CVE-2026-62050

    WordPress Splendour theme <= 1.23 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Splendour <= 1.23 versions.

    ThemeREX Splendour
  • Critical 9.8
    CVE-2026-62045

    WordPress Booklovers theme <= 2.13.0 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Booklovers booklovers allows Object Injection.This issue affects Booklovers: from n/a through 2.13.0.

    ThemeREX Booklovers
  • Critical 9.8
    CVE-2026-62046

    WordPress Gutentype theme <= 2.1.12 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Gutentype gutentype allows Object Injection.This issue affects Gutentype: from n/a through 2.1.12.

    ThemeREX Gutentype
  • Critical 9.8
    CVE-2026-93944

    WordPress Camelia theme <= 1.2.15 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Camelia camelia allows Object Injection.This issue affects Camelia: from n/a through 1.2.15.

    ThemeREX Camelia
  • Critical 9.8
    CVE-2026-93942

    WordPress Dwell theme <= 1.16.0 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Dwell dwell allows Object Injection.This issue affects Dwell: from n/a through 1.16.0.

    ThemeREX Dwell
  • Critical 9.8
    CVE-2026-93943

    WordPress Convex theme <= 1.16.0 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Convex convex allows Object Injection.This issue affects Convex: from n/a through 1.16.0.

    ThemeREX Convex
  • Critical 9.8
    CVE-2026-93937

    WordPress Hygia theme <= 1.21.0 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Hygia hygia allows Object Injection.This issue affects Hygia: from n/a through 1.21.0.

    ThemeREX Hygia
  • Critical 9.8
    CVE-2026-93938

    WordPress Hogwords theme <= 1.2.7 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Hogwords hogwords allows Object Injection.This issue affects Hogwords: from n/a through 1.2.7.

    ThemeREX Hogwords
  • Critical 9.8
    CVE-2026-93940

    WordPress Greeny theme <= 2.10.0 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Greeny greeny allows Object Injection.This issue affects Greeny: from n/a through 2.10.0.

    ThemeREX Greeny
  • Critical 9.8
    CVE-2026-93941

    WordPress Edema theme <= 1.2.2.2 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Edema edema allows Object Injection.This issue affects Edema: from n/a through 1.2.2.2.

    ThemeREX Edema
  • Critical 9.8
    CVE-2026-93936

    WordPress IPharm theme <= 1.2.4 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Group IPharm ipharm allows Object Injection.This issue affects IPharm: from n/a through 1.2.4.

    ThemeREX IPharm
  • Critical 9.8
    CVE-2026-93934

    WordPress Partiso theme <= 1.1.13 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Partiso partiso allows Object Injection.This issue affects Partiso: from n/a through 1.1.13.

    ThemeREX Partiso
  • Critical 9.8
    CVE-2026-93935

    WordPress Let's Play theme <= 1.1.15 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Let's Play playhockey allows Object Injection.This issue affects Let's Play: from n/a through 1.1.15.

    ThemeREX Let's Play
  • Critical 9.8
    CVE-2026-93931

    WordPress Smash theme <= 1.12.0 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Smash smash allows Object Injection.This issue affects Smash: from n/a through 1.12.0.

    ThemeREX Smash
  • Critical 9.8
    CVE-2026-93930

    WordPress Tantra theme <= 2.9.0 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Tantra tantra allows Object Injection.This issue affects Tantra: from n/a through 2.9.0.

    ThemeREX Tantra
  • Critical 9.8
    CVE-2026-93932

    WordPress Smart Casa theme <= 1.0.12 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Smart Casa smart-casa allows Object Injection.This issue affects Smart Casa: from n/a through 1.0.12.

    ThemeREX Smart Casa
  • Critical 9.8
    CVE-2026-93933

    WordPress Rosalinda theme <= 1.2.4 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Rosalinda rosalinda allows Object Injection.This issue affects Rosalinda: from n/a through 1.2.4.

    ThemeREX Rosalinda
  • Critical 9.8
    CVE-2026-93929

    WordPress Travesia theme <= 1.1.16 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Travesia travesia allows Object Injection.This issue affects Travesia: from n/a through 1.1.16.

    ThemeREX Travesia
  • Critical 9.8
    CVE-2026-62105

    WordPress ThemeREX Addons plugin < 2.45.0 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in ThemeREX Addons < 2.45.0 versions.

    ThemeREX ThemeREX Addons
  • Critical 9.8
    CVE-2026-66650

    WordPress FreightCo theme <= 1.1.15 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in FreightCo <= 1.1.15 versions.

    ThemeREX FreightCo
  • Critical 9.8
    CVE-2026-65573

    WordPress Abelle theme <= 1.22 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Abelle <= 1.22 versions.

    ThemeREX Abelle
  • Critical 9.8
    CVE-2025-69127

    WordPress Plumbing theme <= 1.6 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Plumbing <= 1.6 versions.

    ThemeREX Plumbing
  • Critical 9.8
    CVE-2025-69111

    WordPress Reisen theme <= 1.4.1 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Reisen <= 1.4.1 versions.

    ThemeREX Reisen
  • Critical 9.8
    CVE-2025-60205

    WordPress ThemeREX Addons plugin <= 2.36.1.1 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Object Injection.This issue affects ThemeREX Addons: from n/a through 2.36.1.1.

    ThemeREX ThemeREX Addons
  • Critical 9.8
    CVE-2026-39529

    WordPress Elementra theme <= 1.0.9 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Elementra <= 1.0.9 versions.

    ThemeREX Elementra
  • Critical 9.8
    CVE-2025-69122

    WordPress SeaFood Company theme <= 1.4 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in SeaFood Company <= 1.4 versions.

    ThemeREX SeaFood Company
  • Critical 9.8
    CVE-2025-69108

    WordPress Hot Coffee theme <= 1.7 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Hot Coffee <= 1.7 versions.

    ThemeREX Hot Coffee
  • Critical 9.8
    CVE-2026-27083

    WordPress Work & Travel Company theme <= 1.2 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Work & Travel Company work-travel-company allows Object Injection.This issue affects Work & Travel Company: from n/a through <= 1.2.

    ThemeREX Work & Travel Company
  • Critical 9.8
    CVE-2026-27082

    WordPress Love Story theme <= 1.3.12 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Love Story lovestory allows Object Injection.This issue affects Love Story: from n/a through <= 1.3.12.

    ThemeREX Love Story
  • Critical 9.8
    CVE-2026-27084

    WordPress Buisson theme <= 1.1.11 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Buisson buisson allows Object Injection.This issue affects Buisson: from n/a through <= 1.1.11.

    ThemeREX Buisson
  • Critical 9.8
    CVE-2026-28105

    WordPress Good Energy theme <= 1.7.7 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Good Energy goodenergy allows Object Injection.This issue affects Good Energy: from n/a through <= 1.7.7.

    ThemeREX Good Energy
  • Critical 9.8
    CVE-2026-28074

    WordPress Pizza House theme <= 1.4.0 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Pizza House pizzahouse allows Object Injection.This issue affects Pizza House: from n/a through <= 1.4.0.

    ThemeREX Pizza House