CVE Intelligence

ThemeREX Group vulnerabilities

🔔 Create alert RSS

Published CVEs affecting ThemeREX Group products: 22 record(s), with severity, exploitation and fixes.

Smart Casa 1ThemeREX Addons 1Smash 1Hogwords 1Camelia 1Rosalinda 1Greeny 1Hygia 1Let's Play 1Dwell 1Tantra 1Elementra 1Booklovers 1Kids Planet 1Learnify 1Geya 1Edema 1IPharm 1Convex 1Partiso 1Travesia 1Gutentype 1

Exploited only (KEV) →

CVE-2026-57742 High · 7.1 CWE-79 Oct 10, 2026
WordPress Kids Planet theme <= 2.2.14.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group Kids Planet allows Reflected XSS. This issue affects Kids Planet: from n/a through 2.2.14.2.
CVE-2026-93944 Critical · 9.8 CWE-502 Oct 10, 2026
WordPress Camelia theme <= 1.2.15 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeREX Group Camelia camelia allows Object Injection.This issue affects Camelia: from n/a through 1.2.15.
CVE-2026-93943 Critical · 9.8 CWE-502 Oct 10, 2026
WordPress Convex theme <= 1.16.0 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeREX Group Convex convex allows Object Injection.This issue affects Convex: from n/a through 1.16.0.
CVE-2026-93942 Critical · 9.8 CWE-502 Oct 10, 2026
WordPress Dwell theme <= 1.16.0 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeREX Group Dwell dwell allows Object Injection.This issue affects Dwell: from n/a through 1.16.0.
CVE-2026-93941 Critical · 9.8 CWE-502 Oct 10, 2026
WordPress Edema theme <= 1.2.2.2 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeREX Group Edema edema allows Object Injection.This issue affects Edema: from n/a through 1.2.2.2.
CVE-2026-93940 Critical · 9.8 CWE-502 Oct 10, 2026
WordPress Greeny theme <= 2.10.0 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeREX Group Greeny greeny allows Object Injection.This issue affects Greeny: from n/a through 2.10.0.
CVE-2026-93938 Critical · 9.8 CWE-502 Oct 10, 2026
WordPress Hogwords theme <= 1.2.7 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeREX Group Hogwords hogwords allows Object Injection.This issue affects Hogwords: from n/a through 1.2.7.
CVE-2026-93937 Critical · 9.8 CWE-502 Oct 10, 2026
WordPress Hygia theme <= 1.21.0 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeREX Group Hygia hygia allows Object Injection.This issue affects Hygia: from n/a through 1.21.0.
CVE-2026-93936 Critical · 9.8 CWE-502 Oct 10, 2026
WordPress IPharm theme <= 1.2.4 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeREX Group IPharm ipharm allows Object Injection.This issue affects IPharm: from n/a through 1.2.4.
CVE-2026-93935 Critical · 9.8 CWE-502 Oct 10, 2026
WordPress Let's Play theme <= 1.1.15 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeREX Group Let's Play playhockey allows Object Injection.This issue affects Let's Play: from n/a through 1.1.15.
CVE-2026-93934 Critical · 9.8 CWE-502 Oct 10, 2026
WordPress Partiso theme <= 1.1.13 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeREX Group Partiso partiso allows Object Injection.This issue affects Partiso: from n/a through 1.1.13.
CVE-2026-93933 Critical · 9.8 CWE-502 Oct 10, 2026
WordPress Rosalinda theme <= 1.2.4 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeREX Group Rosalinda rosalinda allows Object Injection.This issue affects Rosalinda: from n/a through 1.2.4.
CVE-2026-93932 Critical · 9.8 CWE-502 Oct 10, 2026
WordPress Smart Casa theme <= 1.0.12 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeREX Group Smart Casa smart-casa allows Object Injection.This issue affects Smart Casa: from n/a through 1.0.12.
CVE-2026-93931 Critical · 9.8 CWE-502 Oct 10, 2026
WordPress Smash theme <= 1.12.0 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeREX Group Smash smash allows Object Injection.This issue affects Smash: from n/a through 1.12.0.
CVE-2026-93930 Critical · 9.8 CWE-502 Oct 10, 2026
WordPress Tantra theme <= 2.9.0 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeREX Group Tantra tantra allows Object Injection.This issue affects Tantra: from n/a through 2.9.0.
CVE-2026-93929 Critical · 9.8 CWE-502 Oct 10, 2026
WordPress Travesia theme <= 1.1.16 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeREX Group Travesia travesia allows Object Injection.This issue affects Travesia: from n/a through 1.1.16.
CVE-2026-62046 Critical · 9.8 CWE-502 Oct 10, 2026
WordPress Gutentype theme <= 2.1.12 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeREX Group Gutentype gutentype allows Object Injection.This issue affects Gutentype: from n/a through 2.1.12.
CVE-2026-62045 Critical · 9.8 CWE-502 Oct 10, 2026
WordPress Booklovers theme <= 2.13.0 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeREX Group Booklovers booklovers allows Object Injection.This issue affects Booklovers: from n/a through 2.13.0.
CVE-2026-39529 Critical · 9.8 CWE-502 Jun 17, 2026
WordPress Elementra theme <= 1.0.9 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Elementra <= 1.0.9 versions.
CVE-2025-60205 Critical · 9.8 CWE-502 Jun 17, 2026
WordPress ThemeREX Addons plugin <= 2.36.1.1 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Object Injection.This issue affects ThemeREX Addons: from n/a through 2.36.1.1.
CVE-2025-60085 High · 8.1 CWE-98 Jun 17, 2026
WordPress Learnify theme <= 1.15.0 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Learnify <= 1.15.0 versions.
CVE-2025-58924 High · 8.1 CWE-98 Jun 17, 2026
WordPress Geya theme <= 1.15 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Geya <= 1.15 versions.