CVE Intelligence

ThemeREX vulnerabilities

🔔 Create alert RSS

Published CVEs affecting ThemeREX products: 202 record(s), with severity, exploitation and fixes.

ThemeREX Addons 3Splendour 2FreightCo 2Alliance 2Equadio 2ShiftCV 2Stargaze 2Invetex 2N7 | Golf Club Sports & Events 2Law Office 2Yacht Rental 2Booked 2Abelle 2Asia Garden 2Windsor 2WineShop 2Education Center 2Tipsy 2Gable 1Tint 1Plank 1Cobble 1Yokoo 1R&F 1Extreme Store 1Lorem Ipsum | Books & Media Store 1Pets Club 1Solaris 1Equestrian Centre 1Tennis Club 1Humanum 1OsTende 1The Qlean 1Quanzo 1ConFix 1Avventure 1Meals & Wheels 1Aldo 1Tediss 1Justitia 1

Exploited only (KEV) →

CVE-2025-69113 High · 8.1 CWE-98 Jun 17, 2026
WordPress Nexio theme <= 1.10.0 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Nexio <= 1.10.0 versions.
CVE-2025-69112 High · 8.1 CWE-98 Jun 17, 2026
WordPress Planty theme <= 1.14.0 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Planty <= 1.14.0 versions.
CVE-2025-69110 High · 8.1 CWE-98 Jun 17, 2026
WordPress AirSupply theme <= 2.0.0 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in AirSupply <= 2.0.0 versions.
CVE-2025-69109 High · 8.1 CWE-98 Jun 17, 2026
WordPress Raider Spirit theme <= 1.1.2 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Raider Spirit <= 1.1.2 versions.
CVE-2025-69108 Critical · 9.8 CWE-502 Jun 17, 2026
WordPress Hot Coffee theme <= 1.7 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Hot Coffee <= 1.7 versions.
CVE-2025-69107 High · 8.1 CWE-98 Jun 17, 2026
WordPress Rosaleen theme <= 2.8 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Rosaleen <= 2.8 versions.
CVE-2025-69105 High · 8.1 CWE-98 Jun 17, 2026
WordPress Modernee theme <= 1.6.0 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Modernee <= 1.6.0 versions.
CVE-2025-58954 High · 8.1 CWE-98 Jun 17, 2026
WordPress HomeRoofer theme <= 2.11.0 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in HomeRoofer <= 2.11.0 versions.
CVE-2025-58953 High · 8.1 CWE-98 Jun 17, 2026
WordPress Joly theme <= 1.22.0 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Joly <= 1.22.0 versions.
CVE-2025-58952 High · 8.1 CWE-98 Jun 17, 2026
WordPress Neuronet theme < 1.14.0 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Neuronet < 1.14.0 versions.
CVE-2026-27084 Critical · 9.8 CWE-502 Mar 25, 2026
ThemeREX Buisson WordPress Theme: Insecure Deserialization (Object Injection)
Deserialization of Untrusted Data vulnerability in ThemeREX Buisson buisson allows Object Injection.This issue affects Buisson: from n/a through <= 1.1.11.
CVE-2026-27083 Critical · 9.8 CWE-502 Mar 25, 2026
Work & Travel Company WordPress Theme PHP Object Injection via Deserialization (CVE-2026-27083)
Deserialization of Untrusted Data vulnerability in ThemeREX Work & Travel Company work-travel-company allows Object Injection.This issue affects Work & Travel Company: from n/a through <= 1.2.
CVE-2026-27082 Critical · 9.8 CWE-502 Mar 25, 2026
ThemeREX Love Story WordPress Theme - Object Injection via Deserialization (CVE-2026-27082)
Deserialization of Untrusted Data vulnerability in ThemeREX Love Story lovestory allows Object Injection.This issue affects Love Story: from n/a through <= 1.3.12.
CVE-2026-22504 High · 8.1 CWE-98 Mar 25, 2026
WordPress ProLingua theme <= 1.1.12 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX ProLingua prolingua allows PHP Local File Inclusion.This issue affects ProLingua: from n/a through <= 1.1.12.
CVE-2026-22503 High · 8.1 CWE-98 Mar 25, 2026
WordPress Nelson theme <= 1.2.0 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Nelson nelson allows PHP Local File Inclusion.This issue affects Nelson: from n/a through <= 1.2.0.
CVE-2026-22494 High · 8.1 CWE-98 Mar 25, 2026
WordPress Good Homes theme <= 1.3.13 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Good Homes good-homes allows PHP Local File Inclusion.This issue affects Good Homes: from n/a through <= 1.3.13.
CVE-2026-22324 High · 8.1 CWE-98 Mar 20, 2026
WordPress Melania theme <= 2.5.0 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Melania allows PHP Local File Inclusion.This issue affects Melania: from n/a through 2.5.0.
CVE-2026-28128 High · 8.1 CWE-98 Mar 5, 2026
WordPress Verse theme <= 1.7.0 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Verse verse allows PHP Local File Inclusion.This issue affects Verse: from n/a through <= 1.7.0.
CVE-2026-28120 High · 8.1 CWE-98 Mar 5, 2026
WordPress Dr.Patterson theme <= 1.3.2 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Dr.Patterson dr-patterson allows PHP Local File Inclusion.This issue affects Dr.Patterson: from n/a through <= 1.3.2.
CVE-2026-28107 High · 8.1 CWE-98 Mar 5, 2026
WordPress Muzicon theme <= 1.9.0 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Muzicon muzicon allows PHP Local File Inclusion.This issue affects Muzicon: from n/a through <= 1.9.0.
CVE-2026-28105 Critical · 9.8 CWE-502 Mar 5, 2026
WordPress Good Energy theme <= 1.7.7 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in ThemeREX Good Energy goodenergy allows Object Injection.This issue affects Good Energy: from n/a through <= 1.7.7.
CVE-2026-28098 High · 8.1 CWE-98 Mar 5, 2026
WordPress Save Life theme <= 1.2.13 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Save Life save-life allows PHP Local File Inclusion.This issue affects Save Life: from n/a through <= 1.2.13.
CVE-2026-28097 High · 8.1 CWE-98 Mar 5, 2026
WordPress Artrium theme <= 1.0.14 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Artrium artrium allows PHP Local File Inclusion.This issue affects Artrium: from n/a through <= 1.0.14.
CVE-2026-28096 High · 8.1 CWE-98 Mar 5, 2026
WordPress WealthCo theme <= 2.18 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX WealthCo wealthco allows PHP Local File Inclusion.This issue affects WealthCo: from n/a through <= 2.18.
CVE-2026-28095 High · 8.1 CWE-98 Mar 5, 2026
WordPress Marcell theme <= 1.2.14 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Marcell marcell allows PHP Local File Inclusion.This issue affects Marcell: from n/a through <= 1.2.14.