Skip to content
OpenAdvisories

Vendor

ThemeREX

266 known vulnerabilities.

Products

ThemeREX Addons 9 Puzzles | WP Magazine / Review with Store WordPress Theme + RTL 3 Tipsy 2 ShiftCV 2 Save Life 2 Ozisti 2 Filmax 2 Education Center 2 Preservation 2 Motorix 2 Marcell 2 Muzicon 2 Invetex 2 Asia Garden 2 Booked 2 Law Office 2 RexCoin 2 EmojiNation 2 Stargaze 2 N7 | Golf Club Sports & Events 2 FreightCo 2 Le Truffe 2 Bonbon 2 Coinpress 2 Edge Decor 2 Yacht Rental 2 Splendour 2 Gunslinger 2 Windsor 2 Nuts 2 Gamezone 2 Gamic 2 Printy 2 Avventure 2 Meals & Wheels 2 WineShop 2 Alliance 2 Quirky 2 Legal Stone 2 Orpheus 2
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 6.4
    CVE-2026-102797

    WordPress ThemeREX Addons plugin <= 2.46.0 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Server Side Request Forgery.This issue affects ThemeREX Addons: from n/a through 2.46.0.

    ThemeREX ThemeREX Addons
  • Medium 6.5
    CVE-2026-102798

    WordPress ThemeREX Addons plugin <= 2.46.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Stored XSS.This issue affects ThemeREX Addons: from n/a through 2.46.0.

    ThemeREX ThemeREX Addons
  • Medium 6.5
    CVE-2026-97236

    WordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scripting (XSS) vulnerability

    Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.

    ThemeREX ThemeREX Addons
  • Medium 6.5
    CVE-2026-57747

    WordPress Booked plugin <= 3.0.0 - Cross Site Request Forgery (CSRF) vulnerability

    Unauthenticated Cross Site Request Forgery (CSRF) in Booked <= 3.0.0 versions.

    ThemeREX Booked
  • Medium 6.4
    CVE-2025-6997

    ThemeREX Addons <= 2.35.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via trx_addons_get_svg_from_file Function

    The ThemeREX Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.35.1.1 due to insufficient input sanitization and output escaping. The plugin’s SVG rendering routine calls the …

    ThemeREX ThemeREX Addons Web / CMS
  • Medium 6.4
    CVE-2025-0837

    Puzzles <= 4.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The Puzzles theme for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 4.2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate…

    ThemeREX Puzzles | WP Magazine / Review with Store WordPress Theme + RTL Web / CMS
  • Medium 6.4
    CVE-2024-13769

    Puzzles | WP Magazine / Review with Store WordPress Theme + RTL <= 4.2.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting

    The Puzzles | WP Magazine / Review with Store WordPress Theme + RTL theme for WordPress is vulnerable to Stored Cross-Site Scripting due to a missing capability check on the 'theme_options_ajax_post_action' AJAX action in all versions up to, and including, 4.…

    ThemeREX Puzzles | WP Magazine / Review with Store WordPress Theme + RTL Web / CMS