CVE Intelligence

ThemeREX vulnerabilities

🔔 Create alert RSS

Published CVEs affecting ThemeREX products: 202 record(s), with severity, exploitation and fixes.

ThemeREX Addons 3Splendour 2FreightCo 2Alliance 2Equadio 2ShiftCV 2Stargaze 2Invetex 2N7 | Golf Club Sports & Events 2Law Office 2Yacht Rental 2Booked 2Abelle 2Asia Garden 2Windsor 2WineShop 2Education Center 2Tipsy 2Gable 1Tint 1Plank 1Cobble 1Yokoo 1R&F 1Extreme Store 1Lorem Ipsum | Books & Media Store 1Pets Club 1Solaris 1Equestrian Centre 1Tennis Club 1Humanum 1OsTende 1The Qlean 1Quanzo 1ConFix 1Avventure 1Meals & Wheels 1Aldo 1Tediss 1Justitia 1

Exploited only (KEV) →

CVE-2026-81797 Critical · 9.8 CWE-502 Oct 10, 2026
WordPress Buzz Stone | Magazine & Viral Blog WordPress Theme theme <= 1.0.2 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions.
CVE-2026-78535 Critical · 9.8 CWE-502 Oct 10, 2026
WordPress Photolia theme <= 1.0.3 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.
CVE-2026-78531 Critical · 9.8 CWE-502 Oct 10, 2026
WordPress Jacqueline theme <= 2.22 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.
CVE-2026-78529 Critical · 9.8 CWE-502 Oct 10, 2026
WordPress Alliance theme <= 3.11 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.
CVE-2026-66564 Critical · 9.8 CWE-502 Oct 10, 2026
WordPress ShiftCV theme <= 3.0.14 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.
CVE-2026-66563 Critical · 9.8 CWE-502 Oct 10, 2026
WordPress Windsor theme <= 2.10 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.
CVE-2026-66483 Critical · 9.8 CWE-502 Oct 10, 2026
WordPress Education Center theme <= 3.6.12 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions.
CVE-2026-62125 Critical · 9.8 CWE-502 Oct 10, 2026
WordPress Asia Garden theme <= 1.3.1 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions.
CVE-2026-62124 Critical · 9.8 CWE-502 Oct 10, 2026
WordPress N7 | Golf Club Sports & Events theme <= 2.21 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions.
CVE-2026-62123 Critical · 9.8 CWE-502 Oct 10, 2026
WordPress Invetex theme <= 2.18 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Invetex <= 2.18 versions.
CVE-2026-62120 Critical · 9.8 CWE-502 Oct 10, 2026
WordPress Law Office theme <= 3.20 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Law Office <= 3.20 versions.
CVE-2026-62090 Critical · 9.8 CWE-502 Oct 10, 2026
WordPress WineShop theme <= 3.20 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in WineShop <= 3.20 versions.
CVE-2026-62087 Critical · 9.8 CWE-502 Oct 10, 2026
WordPress Equadio theme <= 1.1.4 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions.
CVE-2026-62086 Critical · 9.8 CWE-502 Oct 10, 2026
WordPress Juno theme <= 2.25 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Juno <= 2.25 versions.
CVE-2026-62074 High · 8.1 CWE-98 Oct 10, 2026
WordPress Ozeum theme <= 1.3.0 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Ozeum <= 1.3.0 versions.
CVE-2026-62054 Critical · 9.8 CWE-502 Oct 10, 2026
WordPress Yacht Rental theme <= 2.6 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions.
CVE-2026-62053 Critical · 9.8 CWE-502 Oct 10, 2026
WordPress Wine House theme <= 3.20 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Wine House <= 3.20 versions.
CVE-2026-62052 Critical · 9.8 CWE-502 Oct 10, 2026
WordPress Tipsy theme <= 1.6 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions.
CVE-2026-62051 Critical · 9.8 CWE-502 Oct 10, 2026
WordPress Stargaze theme <= 1.10 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions.
CVE-2026-62050 Critical · 9.8 CWE-502 Oct 10, 2026
WordPress Splendour theme <= 1.23 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Splendour <= 1.23 versions.
CVE-2026-94063 High · 7.1 CWE-79 Oct 9, 2026
WordPress Education Center theme <= 3.6.12 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Education Center education allows Reflected XSS.This issue affects Education Center: from n/a through 3.6.12.
CVE-2026-97236 Medium · 6.5 CWE-79 Sep 30, 2026
WordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.
CVE-2026-97235 High · 7.1 CWE-79 Sep 30, 2026
WordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.
CVE-2026-62105 Critical · 9.8 CWE-502 Sep 11, 2026
WordPress ThemeREX Addons plugin < 2.45.0 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in ThemeREX Addons < 2.45.0 versions.
CVE-2026-66650 Critical · 9.8 CWE-502 Aug 24, 2026
WordPress FreightCo theme <= 1.1.15 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in FreightCo <= 1.1.15 versions.