Skip to content
OpenAdvisories

Vendor

ThemeREX

266 known vulnerabilities.

Products

ThemeREX Addons 9 Puzzles | WP Magazine / Review with Store WordPress Theme + RTL 3 Tipsy 2 ShiftCV 2 Save Life 2 Ozisti 2 Filmax 2 Education Center 2 Preservation 2 Motorix 2 Marcell 2 Muzicon 2 Invetex 2 Asia Garden 2 Booked 2 Law Office 2 RexCoin 2 EmojiNation 2 Stargaze 2 N7 | Golf Club Sports & Events 2 FreightCo 2 Le Truffe 2 Bonbon 2 Coinpress 2 Edge Decor 2 Yacht Rental 2 Splendour 2 Gunslinger 2 Windsor 2 Nuts 2 Gamezone 2 Gamic 2 Printy 2 Avventure 2 Meals & Wheels 2 WineShop 2 Alliance 2 Quirky 2 Legal Stone 2 Orpheus 2
All Critical High Medium Low Exploited only Public exploit

266 results · Feed

  • Critical 9.8
    CVE-2026-22453

    WordPress Pets Club theme <= 2.3 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Pets Club petclub allows Object Injection.This issue affects Pets Club: from n/a through <= 2.3.

    ThemeREX Pets Club
  • High 8.1
    CVE-2026-22452

    WordPress Hoverex theme <= 1.5.10 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Hoverex hoverex allows PHP Local File Inclusion.This issue affects Hoverex: from n/a through <= 1.5.10.

    ThemeREX Hoverex
  • High 8.1
    CVE-2026-22443

    WordPress Alliance theme <= 3.1.1 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Alliance alliance allows PHP Local File Inclusion.This issue affects Alliance: from n/a through <= 3.1.1.

    ThemeREX Alliance
  • High 8.1
    CVE-2025-53335

    WordPress Berger theme <= 1.1.1 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Berger berger allows PHP Local File Inclusion.This issue affects Berger: from n/a through <= 1.1.1.

    ThemeREX Berger
  • Critical 9.8
    CVE-2025-54001

    WordPress Classter theme <= 2.5 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Classter classter allows Object Injection.This issue affects Classter: from n/a through <= 2.5.

    ThemeREX Classter
  • High 8.1
    CVE-2025-69406

    WordPress FreightCo theme <= 1.1.7 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX FreightCo freightco allows PHP Local File Inclusion.This issue affects FreightCo: from n/a through <= 1.1.7.

    ThemeREX FreightCo
  • Critical 9.8
    CVE-2025-69405

    WordPress Lorem Ipsum | Books & Media Store theme <= 1.2.11 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Lorem Ipsum | Books & Media Store lorem-ipsum-books-media-store allows Object Injection.This issue affects Lorem Ipsum | Books & Media Store: from n/a through <= 1.2.11.

    ThemeREX Lorem Ipsum | Books & Media Store
  • High 8.1
    CVE-2025-69400

    WordPress Yokoo theme <= 1.1.11 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Yokoo yokoo allows PHP Local File Inclusion.This issue affects Yokoo: from n/a through <= 1.1.11.

    ThemeREX Yokoo
  • Critical 9.8
    CVE-2025-69404

    WordPress Extreme Store theme <= 1.5.10 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Extreme Store extremestore allows Object Injection.This issue affects Extreme Store: from n/a through <= 1.5.10.

    ThemeREX Extreme Store
  • High 8.1
    CVE-2025-69402

    WordPress R&F theme <= 1.5 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX R&F rf allows PHP Local File Inclusion.This issue affects R&F: from n/a through <= 1.5.

    ThemeREX R&F
  • High 8.1
    CVE-2025-69399

    WordPress Cobble theme <= 1.7 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Cobble cobble allows PHP Local File Inclusion.This issue affects Cobble: from n/a through <= 1.7.

    ThemeREX Cobble
  • High 8.1
    CVE-2025-69398

    WordPress Plank theme <= 1.7 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Plank plank allows PHP Local File Inclusion.This issue affects Plank: from n/a through <= 1.7.

    ThemeREX Plank
  • High 8.1
    CVE-2025-69396

    WordPress Splendour theme <= 1.23 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Splendour splendour allows PHP Local File Inclusion.This issue affects Splendour: from n/a through <= 1.23.

    ThemeREX Splendour
  • High 8.1
    CVE-2025-69397

    WordPress Tint theme <= 1.7 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Tint tint allows PHP Local File Inclusion.This issue affects Tint: from n/a through <= 1.7.

    ThemeREX Tint
  • High 8.1
    CVE-2025-69395

    WordPress Gable theme <= 1.5 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Gable gable allows PHP Local File Inclusion.This issue affects Gable: from n/a through <= 1.5.

    ThemeREX Gable
  • Critical 9.8
    CVE-2025-69079

    WordPress Sound | Musical Instruments Online Store theme <= 1.6.9 - Deserialization of untrusted data vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Sound | Musical Instruments Online Store musicplace allows Object Injection.This issue affects Sound | Musical Instruments Online Store: from n/a through <= 1.6.9.

    ThemeREX Sound | Musical Instruments Online Store
  • High 8.1
    CVE-2025-69081

    WordPress Hope theme <= 3.0.0 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Hope charity-is-hope allows PHP Local File Inclusion.This issue affects Hope: from n/a through <= 3.0.0.

    ThemeREX Hope
  • Critical 9.8
    CVE-2025-49890

    WordPress Organic Beauty Theme <= 1.4.6 - PHP Object Injection Vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Organic Beauty organic-beauty allows Object Injection.This issue affects Organic Beauty: from n/a through <= 1.4.6.

    ThemeREX Organic Beauty
  • Medium 6.4
    CVE-2025-6997

    ThemeREX Addons <= 2.35.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via trx_addons_get_svg_from_file Function

    The ThemeREX Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.35.1.1 due to insufficient input sanitization and output escaping. The plugin’s SVG rendering routine calls the …

    ThemeREX ThemeREX Addons Web / CMS
  • Critical 9.8
    CVE-2024-13786

    Education Center | LMS & Online Courses WordPress Theme <= 3.6.10 - PHP Object Injection

    The education theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.6.10 via deserialization of untrusted input in the 'themerex_callback_view_more_posts' function. This makes it possible for unauthenticated attacke…

    ThemeREX Education Center | LMS & Online Courses WordPress Theme Web / CMS
  • High 8.1
    CVE-2024-13770

    Puzzles | WP Magazine / Review with Store WordPress Theme + RTL <= 4.2.4 - Unauthenticated PHP Object Injection

    The Puzzles | WP Magazine / Review with Store WordPress Theme + RTL theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.2.4 via deserialization of untrusted input 'view_more_posts' AJAX action. This makes it possi…

    ThemeREX Puzzles | WP Magazine / Review with Store WordPress Theme + RTL Web / CMS
  • Medium 6.4
    CVE-2025-0837

    Puzzles <= 4.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The Puzzles theme for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 4.2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate…

    ThemeREX Puzzles | WP Magazine / Review with Store WordPress Theme + RTL Web / CMS
  • Medium 6.4
    CVE-2024-13769

    Puzzles | WP Magazine / Review with Store WordPress Theme + RTL <= 4.2.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting

    The Puzzles | WP Magazine / Review with Store WordPress Theme + RTL theme for WordPress is vulnerable to Stored Cross-Site Scripting due to a missing capability check on the 'theme_options_ajax_post_action' AJAX action in all versions up to, and including, 4.…

    ThemeREX Puzzles | WP Magazine / Review with Store WordPress Theme + RTL Web / CMS
  • Critical 9.8
    CVE-2024-13448

    ThemeREX Addons <= 2.32.3 - Unauthenticated Arbitrary File Upload in trx_addons_uploads_save_data

    The ThemeREX Addons plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'trx_addons_uploads_save_data' function in all versions up to, and including, 2.32.3. This makes it possible for unauthenticated attack…

    ThemeREX ThemeREX Addons Web / CMS
  • High 8.8
    CVE-2025-0682

    ThemeREX Addons <= 2.33.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode

    The ThemeREX Addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.33.0 via the 'trx_sc_reviews' shortcode 'type' attribute. This makes it possible for authenticated attackers, with contributor-level and abo…

    ThemeREX ThemeREX Addons Web / CMS
  • Critical 10.0
    CVE-2024-6297 Public exploit

    Several WordPress.org Plugins <= Various Versions - Injected Backdoor

    Several plugins for WordPress hosted on WordPress.org have been compromised and injected with malicious PHP scripts. A malicious threat actor compromised the source code of various plugins and injected code that exfiltrates database credentials and is used to…

    ThemeREX Warfare Plugins stuartobrien pedrogusmao02