Skip to content
OpenAdvisories

Vendor

ThemeREX

266 known vulnerabilities.

Products

ThemeREX Addons 9 Puzzles | WP Magazine / Review with Store WordPress Theme + RTL 3 Tipsy 2 ShiftCV 2 Save Life 2 Ozisti 2 Filmax 2 Education Center 2 Preservation 2 Motorix 2 Marcell 2 Muzicon 2 Invetex 2 Asia Garden 2 Booked 2 Law Office 2 RexCoin 2 EmojiNation 2 Stargaze 2 N7 | Golf Club Sports & Events 2 FreightCo 2 Le Truffe 2 Bonbon 2 Coinpress 2 Edge Decor 2 Yacht Rental 2 Splendour 2 Gunslinger 2 Windsor 2 Nuts 2 Gamezone 2 Gamic 2 Printy 2 Avventure 2 Meals & Wheels 2 WineShop 2 Alliance 2 Quirky 2 Legal Stone 2 Orpheus 2
All Critical High Medium Low Exploited only Public exploit

266 results · Feed

  • Critical 9.8
    CVE-2026-62123

    WordPress Invetex theme <= 2.18 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Invetex <= 2.18 versions.

    ThemeREX Invetex
  • Critical 9.8
    CVE-2026-62124

    WordPress N7 | Golf Club Sports & Events theme <= 2.21 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions.

    ThemeREX N7 | Golf Club Sports & Events
  • Critical 9.8
    CVE-2026-62120

    WordPress Law Office theme <= 3.20 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Law Office <= 3.20 versions.

    ThemeREX Law Office
  • Critical 9.8
    CVE-2026-62090

    WordPress WineShop theme <= 3.20 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in WineShop <= 3.20 versions.

    ThemeREX WineShop
  • Critical 9.8
    CVE-2026-62087

    WordPress Equadio theme <= 1.1.4 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions.

    ThemeREX Equadio
  • Critical 9.8
    CVE-2026-62086

    WordPress Juno theme <= 2.25 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Juno <= 2.25 versions.

    ThemeREX Juno
  • High 8.1
    CVE-2026-62074

    WordPress Ozeum theme <= 1.3.0 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Ozeum <= 1.3.0 versions.

    ThemeREX Ozeum
  • Critical 9.8
    CVE-2026-62054

    WordPress Yacht Rental theme <= 2.6 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions.

    ThemeREX Yacht Rental
  • Critical 9.8
    CVE-2026-62053

    WordPress Wine House theme <= 3.20 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Wine House <= 3.20 versions.

    ThemeREX Wine House
  • Critical 9.8
    CVE-2026-62052

    WordPress Tipsy theme <= 1.6 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions.

    ThemeREX Tipsy
  • Critical 9.8
    CVE-2026-62051

    WordPress Stargaze theme <= 1.10 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions.

    ThemeREX Stargaze
  • Critical 9.8
    CVE-2026-62050

    WordPress Splendour theme <= 1.23 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Splendour <= 1.23 versions.

    ThemeREX Splendour
  • Critical 9.8
    CVE-2026-62045

    WordPress Booklovers theme <= 2.13.0 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Booklovers booklovers allows Object Injection.This issue affects Booklovers: from n/a through 2.13.0.

    ThemeREX Booklovers
  • Critical 9.8
    CVE-2026-62046

    WordPress Gutentype theme <= 2.1.12 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Gutentype gutentype allows Object Injection.This issue affects Gutentype: from n/a through 2.1.12.

    ThemeREX Gutentype
  • Critical 9.8
    CVE-2026-93944

    WordPress Camelia theme <= 1.2.15 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Camelia camelia allows Object Injection.This issue affects Camelia: from n/a through 1.2.15.

    ThemeREX Camelia
  • Critical 9.8
    CVE-2026-93942

    WordPress Dwell theme <= 1.16.0 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Dwell dwell allows Object Injection.This issue affects Dwell: from n/a through 1.16.0.

    ThemeREX Dwell
  • Critical 9.8
    CVE-2026-93943

    WordPress Convex theme <= 1.16.0 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Convex convex allows Object Injection.This issue affects Convex: from n/a through 1.16.0.

    ThemeREX Convex
  • Critical 9.8
    CVE-2026-93937

    WordPress Hygia theme <= 1.21.0 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Hygia hygia allows Object Injection.This issue affects Hygia: from n/a through 1.21.0.

    ThemeREX Hygia
  • Critical 9.8
    CVE-2026-93938

    WordPress Hogwords theme <= 1.2.7 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Hogwords hogwords allows Object Injection.This issue affects Hogwords: from n/a through 1.2.7.

    ThemeREX Hogwords
  • Critical 9.8
    CVE-2026-93940

    WordPress Greeny theme <= 2.10.0 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Greeny greeny allows Object Injection.This issue affects Greeny: from n/a through 2.10.0.

    ThemeREX Greeny
  • Critical 9.8
    CVE-2026-93941

    WordPress Edema theme <= 1.2.2.2 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Edema edema allows Object Injection.This issue affects Edema: from n/a through 1.2.2.2.

    ThemeREX Edema
  • Critical 9.8
    CVE-2026-93936

    WordPress IPharm theme <= 1.2.4 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Group IPharm ipharm allows Object Injection.This issue affects IPharm: from n/a through 1.2.4.

    ThemeREX IPharm
  • Critical 9.8
    CVE-2026-93934

    WordPress Partiso theme <= 1.1.13 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Partiso partiso allows Object Injection.This issue affects Partiso: from n/a through 1.1.13.

    ThemeREX Partiso
  • Critical 9.8
    CVE-2026-93935

    WordPress Let's Play theme <= 1.1.15 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Let's Play playhockey allows Object Injection.This issue affects Let's Play: from n/a through 1.1.15.

    ThemeREX Let's Play
  • Critical 9.8
    CVE-2026-93931

    WordPress Smash theme <= 1.12.0 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Smash smash allows Object Injection.This issue affects Smash: from n/a through 1.12.0.

    ThemeREX Smash
  • Critical 9.8
    CVE-2026-93930

    WordPress Tantra theme <= 2.9.0 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Tantra tantra allows Object Injection.This issue affects Tantra: from n/a through 2.9.0.

    ThemeREX Tantra
  • Critical 9.8
    CVE-2026-93932

    WordPress Smart Casa theme <= 1.0.12 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Smart Casa smart-casa allows Object Injection.This issue affects Smart Casa: from n/a through 1.0.12.

    ThemeREX Smart Casa
  • Critical 9.8
    CVE-2026-93933

    WordPress Rosalinda theme <= 1.2.4 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Rosalinda rosalinda allows Object Injection.This issue affects Rosalinda: from n/a through 1.2.4.

    ThemeREX Rosalinda
  • Critical 9.8
    CVE-2026-93929

    WordPress Travesia theme <= 1.1.16 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Group Travesia travesia allows Object Injection.This issue affects Travesia: from n/a through 1.1.16.

    ThemeREX Travesia
  • High 7.1
    CVE-2026-94063

    WordPress Education Center theme <= 3.6.12 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Education Center education allows Reflected XSS.This issue affects Education Center: from n/a through 3.6.12.

    ThemeREX Education Center
  • Medium 6.4
    CVE-2026-102797

    WordPress ThemeREX Addons plugin <= 2.46.0 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Server Side Request Forgery.This issue affects ThemeREX Addons: from n/a through 2.46.0.

    ThemeREX ThemeREX Addons
  • Medium 6.5
    CVE-2026-102798

    WordPress ThemeREX Addons plugin <= 2.46.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Stored XSS.This issue affects ThemeREX Addons: from n/a through 2.46.0.

    ThemeREX ThemeREX Addons
  • Medium 6.5
    CVE-2026-97236

    WordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scripting (XSS) vulnerability

    Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.

    ThemeREX ThemeREX Addons
  • High 7.1
    CVE-2026-97235

    WordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.

    ThemeREX ThemeREX Addons
  • Critical 9.8
    CVE-2026-62105

    WordPress ThemeREX Addons plugin < 2.45.0 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in ThemeREX Addons < 2.45.0 versions.

    ThemeREX ThemeREX Addons
  • Critical 9.8
    CVE-2026-66650

    WordPress FreightCo theme <= 1.1.15 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in FreightCo <= 1.1.15 versions.

    ThemeREX FreightCo
  • Critical 9.8
    CVE-2026-65573

    WordPress Abelle theme <= 1.22 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Abelle <= 1.22 versions.

    ThemeREX Abelle
  • Medium 6.5
    CVE-2026-57747

    WordPress Booked plugin <= 3.0.0 - Cross Site Request Forgery (CSRF) vulnerability

    Unauthenticated Cross Site Request Forgery (CSRF) in Booked <= 3.0.0 versions.

    ThemeREX Booked
  • High 7.1
    CVE-2026-57746

    WordPress Booked plugin <= 3.0.0 - Broken Access Control vulnerability

    Subscriber Broken Access Control in Booked <= 3.0.0 versions.

    ThemeREX Booked
  • High 8.1
    CVE-2025-69175

    WordPress Line Agency theme <= 1.3.1 - Local File Inclusion vulnerability

    Unauthenticated Local File Inclusion in Line Agency <= 1.3.1 versions.

    ThemeREX Line Agency