Skip to content
OpenAdvisories

Product · ThemeREX

ThemeREX Addons

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 6.4
    CVE-2026-102797

    WordPress ThemeREX Addons plugin <= 2.46.0 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Server Side Request Forgery.This issue affects ThemeREX Addons: from n/a through 2.46.0.

    ThemeREX ThemeREX Addons
  • Medium 6.5
    CVE-2026-102798

    WordPress ThemeREX Addons plugin <= 2.46.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Stored XSS.This issue affects ThemeREX Addons: from n/a through 2.46.0.

    ThemeREX ThemeREX Addons
  • Medium 6.5
    CVE-2026-97236

    WordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scripting (XSS) vulnerability

    Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.

    ThemeREX ThemeREX Addons
  • Medium 6.4
    CVE-2025-6997

    ThemeREX Addons <= 2.35.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via trx_addons_get_svg_from_file Function

    The ThemeREX Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.35.1.1 due to insufficient input sanitization and output escaping. The plugin’s SVG rendering routine calls the …

    ThemeREX ThemeREX Addons Web / CMS