Skip to content
OpenAdvisories

Vendor

ThemeREX

266 known vulnerabilities.

Products

ThemeREX Addons 9 Puzzles | WP Magazine / Review with Store WordPress Theme + RTL 3 Tipsy 2 ShiftCV 2 Save Life 2 Ozisti 2 Filmax 2 Education Center 2 Preservation 2 Motorix 2 Marcell 2 Muzicon 2 Invetex 2 Asia Garden 2 Booked 2 Law Office 2 RexCoin 2 EmojiNation 2 Stargaze 2 N7 | Golf Club Sports & Events 2 FreightCo 2 Le Truffe 2 Bonbon 2 Coinpress 2 Edge Decor 2 Yacht Rental 2 Splendour 2 Gunslinger 2 Windsor 2 Nuts 2 Gamezone 2 Gamic 2 Printy 2 Avventure 2 Meals & Wheels 2 WineShop 2 Alliance 2 Quirky 2 Legal Stone 2 Orpheus 2
All Critical High Medium Low Exploited only Public exploit

266 results · Feed

  • High 8.1
    CVE-2026-28031

    WordPress Invetex theme <= 2.18 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Invetex invetex allows PHP Local File Inclusion.This issue affects Invetex: from n/a through <= 2.18.

    ThemeREX Invetex
  • High 8.1
    CVE-2026-28023

    WordPress Nuts theme <= 1.10 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Nuts nuts allows PHP Local File Inclusion.This issue affects Nuts: from n/a through <= 1.10.

    ThemeREX Nuts
  • High 8.1
    CVE-2026-28025

    WordPress Stargaze theme <= 1.5 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Stargaze stargaze allows PHP Local File Inclusion.This issue affects Stargaze: from n/a through <= 1.5.

    ThemeREX Stargaze
  • High 8.1
    CVE-2026-28027

    WordPress Kayon theme <= 1.3 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Kayon kayon allows PHP Local File Inclusion.This issue affects Kayon: from n/a through <= 1.3.

    ThemeREX Kayon
  • High 8.1
    CVE-2026-28026

    WordPress Motorix theme <= 1.6 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Motorix motorix allows PHP Local File Inclusion.This issue affects Motorix: from n/a through <= 1.6.

    ThemeREX Motorix
  • High 8.1
    CVE-2026-28019

    WordPress Manoir theme <= 1.11 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Manoir manoir allows PHP Local File Inclusion.This issue affects Manoir: from n/a through <= 1.11.

    ThemeREX Manoir
  • High 8.1
    CVE-2026-28020

    WordPress Chroma theme <= 1.11 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Chroma chroma allows PHP Local File Inclusion.This issue affects Chroma: from n/a through <= 1.11.

    ThemeREX Chroma
  • High 8.1
    CVE-2026-28021

    WordPress Craftis theme <= 1.2.8 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Craftis craftis allows PHP Local File Inclusion.This issue affects Craftis: from n/a through <= 1.2.8.

    ThemeREX Craftis
  • High 8.1
    CVE-2026-28022

    WordPress Foodie theme <= 1.14 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Foodie foodie allows PHP Local File Inclusion.This issue affects Foodie: from n/a through <= 1.14.

    ThemeREX Foodie
  • High 8.1
    CVE-2026-28018

    WordPress Global Logistics theme <= 3.20 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Global Logistics globallogistics allows PHP Local File Inclusion.This issue affects Global Logistics: from n/a through <= 3.20.

    ThemeREX Global Logistics
  • High 8.1
    CVE-2026-28016

    WordPress Luxury Wine theme <= 1.1.14 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Luxury Wine luxury-wine allows PHP Local File Inclusion.This issue affects Luxury Wine: from n/a through <= 1.1.14.

    ThemeREX Luxury Wine
  • High 8.1
    CVE-2026-28017

    WordPress Green Thumb theme <= 1.1.12 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Green Thumb greenthumb allows PHP Local File Inclusion.This issue affects Green Thumb: from n/a through <= 1.1.12.

    ThemeREX Green Thumb
  • High 8.1
    CVE-2026-28013

    WordPress Kratz theme <= 1.0.12 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Kratz kratz allows PHP Local File Inclusion.This issue affects Kratz: from n/a through <= 1.0.12.

    ThemeREX Kratz
  • High 8.1
    CVE-2026-28012

    WordPress Gridiron theme <= 1.0.14 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Gridiron gridiron allows PHP Local File Inclusion.This issue affects Gridiron: from n/a through <= 1.0.14.

    ThemeREX Gridiron
  • High 8.1
    CVE-2026-28015

    WordPress ShiftCV theme <= 3.0.14 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX ShiftCV shift-cv allows PHP Local File Inclusion.This issue affects ShiftCV: from n/a through <= 3.0.14.

    ThemeREX ShiftCV
  • High 8.1
    CVE-2026-28011

    WordPress Yottis theme <= 1.0.10 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Yottis yottis allows PHP Local File Inclusion.This issue affects Yottis: from n/a through <= 1.0.10.

    ThemeREX Yottis
  • High 8.1
    CVE-2026-28014

    WordPress Translogic theme <= 1.2.11 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Translogic translogic allows PHP Local File Inclusion.This issue affects Translogic: from n/a through <= 1.2.11.

    ThemeREX Translogic
  • High 8.1
    CVE-2026-28006

    WordPress Yungen theme <= 1.0.12 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Yungen yungen allows PHP Local File Inclusion.This issue affects Yungen: from n/a through <= 1.0.12.

    ThemeREX Yungen
  • High 8.1
    CVE-2026-28007

    WordPress Coinpress theme <= 1.0.14 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Coinpress coinpress allows PHP Local File Inclusion.This issue affects Coinpress: from n/a through <= 1.0.14.

    ThemeREX Coinpress
  • High 8.1
    CVE-2026-28009

    WordPress DroneX theme <= 1.1.12 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX DroneX dronex allows PHP Local File Inclusion.This issue affects DroneX: from n/a through <= 1.1.12.

    ThemeREX DroneX
  • High 8.1
    CVE-2026-28010

    WordPress Scientia theme <= 1.2.4 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Scientia scientia allows PHP Local File Inclusion.This issue affects Scientia: from n/a through <= 1.2.4.

    ThemeREX Scientia
  • High 8.1
    CVE-2026-27998

    WordPress Vixus theme <= 1.0.16 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Vixus vixus allows PHP Local File Inclusion.This issue affects Vixus: from n/a through <= 1.0.16.

    ThemeREX Vixus
  • High 8.1
    CVE-2026-27994

    WordPress Tediss theme <= 1.2.4 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Tediss tediss allows PHP Local File Inclusion.This issue affects Tediss: from n/a through <= 1.2.4.

    ThemeREX Tediss
  • High 8.1
    CVE-2026-27995

    WordPress Justitia theme <= 1.1.0 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Justitia justitia allows PHP Local File Inclusion.This issue affects Justitia: from n/a through <= 1.1.0.

    ThemeREX Justitia
  • High 8.1
    CVE-2026-27997

    WordPress Maxify theme <= 1.0.16 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Maxify maxify allows PHP Local File Inclusion.This issue affects Maxify: from n/a through <= 1.0.16.

    ThemeREX Maxify
  • High 8.1
    CVE-2026-27993

    WordPress Aldo theme <= 1.0.10 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Aldo aldo allows PHP Local File Inclusion.This issue affects Aldo: from n/a through <= 1.0.10.

    ThemeREX Aldo
  • High 8.1
    CVE-2026-27996

    WordPress Lingvico theme <= 1.0.14 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Lingvico lingvico allows PHP Local File Inclusion.This issue affects Lingvico: from n/a through <= 1.0.14.

    ThemeREX Lingvico
  • High 8.1
    CVE-2026-27990

    WordPress ConFix theme <= 1.013 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX ConFix confix allows PHP Local File Inclusion.This issue affects ConFix: from n/a through <= 1.013.

    ThemeREX ConFix
  • High 8.1
    CVE-2026-27989

    WordPress Quanzo theme <= 1.0.10 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Quanzo quanzo allows PHP Local File Inclusion.This issue affects Quanzo: from n/a through <= 1.0.10.

    ThemeREX Quanzo
  • High 8.1
    CVE-2026-27992

    WordPress Meals & Wheels theme <= 1.1.12 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Meals & Wheels meals-wheels allows PHP Local File Inclusion.This issue affects Meals & Wheels: from n/a through <= 1.1.12.

    ThemeREX Meals & Wheels
  • High 8.1
    CVE-2026-27991

    WordPress Avventure theme <= 1.1.12 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Avventure avventure allows PHP Local File Inclusion.This issue affects Avventure: from n/a through <= 1.1.12.

    ThemeREX Avventure
  • High 8.1
    CVE-2026-27986

    WordPress OsTende theme <= 1.4.3 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX OsTende ostende allows PHP Local File Inclusion.This issue affects OsTende: from n/a through <= 1.4.3.

    ThemeREX OsTende
  • High 8.1
    CVE-2026-27987

    WordPress The Qlean theme <= 2.12 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX The Qlean the-qlean allows PHP Local File Inclusion.This issue affects The Qlean: from n/a through <= 2.12.

    ThemeREX The Qlean
  • High 8.1
    CVE-2026-27988

    WordPress Equadio theme <= 1.1.3 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Equadio equadio allows PHP Local File Inclusion.This issue affects Equadio: from n/a through <= 1.1.3.

    ThemeREX Equadio
  • High 8.1
    CVE-2026-27985

    WordPress Humanum theme <= 1.1.4 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Humanum humanum allows PHP Local File Inclusion.This issue affects Humanum: from n/a through <= 1.1.4.

    ThemeREX Humanum
  • Critical 9.8
    CVE-2026-27439

    WordPress Dentario theme <= 1.5 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Dentario dentario allows Object Injection.This issue affects Dentario: from n/a through <= 1.5.

    ThemeREX Dentario
  • Critical 9.8
    CVE-2026-27438

    WordPress Kingler theme <= 1.7 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Kingler kingler allows Object Injection.This issue affects Kingler: from n/a through <= 1.7.

    ThemeREX Kingler
  • Critical 9.8
    CVE-2026-27437

    WordPress Tennis Club theme <= 1.2.3 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Tennis Club tennis-sportclub allows Object Injection.This issue affects Tennis Club: from n/a through <= 1.2.3.

    ThemeREX Tennis Club
  • Critical 9.8
    CVE-2026-22474

    WordPress Equestrian Centre theme <= 1.5 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Equestrian Centre equestrian-centre allows Object Injection.This issue affects Equestrian Centre: from n/a through <= 1.5.

    ThemeREX Equestrian Centre
  • Critical 9.8
    CVE-2026-22454

    WordPress Solaris theme <= 2.5 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Solaris solaris allows Object Injection.This issue affects Solaris: from n/a through <= 2.5.

    ThemeREX Solaris