ThemeREX
Vulnerability activity for ThemeREX: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 47
- Critical (CVSS 9+)
- 45
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 50
- Critical (CVSS 9+)
- 46
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 50
- Critical (CVSS 9+)
- 46
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 9.8CriticalOct 30, 2026ThemeREX Royal Event DeserializationCVE-2026-119526Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection. This issue affects Royal Event: from n/a through 2.0.
- 9.8CriticalOct 29, 2026ThemeREX Gunslinger DeserializationCVE-2026-62018Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.
- 9.8CriticalOct 29, 2026ThemeREX Good Homes DeserializationCVE-2026-62017Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.
- 9.8CriticalOct 29, 2026ThemeREX Gamic DeserializationCVE-2026-62016Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.
- 9.8CriticalOct 29, 2026ThemeREX Gamezone DeserializationCVE-2026-62015Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.
- 9.8CriticalOct 29, 2026ThemeREX EmojiNation DeserializationCVE-2026-62014Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions.
- 9.8CriticalOct 29, 2026ThemeREX Edge Decor DeserializationCVE-2026-62013Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions.
- 9.8CriticalOct 29, 2026ThemeREX Coinpress DeserializationCVE-2026-62012Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions.
- 9.8CriticalOct 29, 2026ThemeREX Bonbon DeserializationCVE-2026-62011Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions.
- 9.8CriticalOct 29, 2026ThemeREX Avventure DeserializationCVE-2026-62010Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions.
- 9.8CriticalOct 29, 2026ThemeREX Filmax DeserializationCVE-2026-62009Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions.
- 9.8CriticalOct 29, 2026ThemeREX Orpheus DeserializationCVE-2026-62008Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.
- 9.8CriticalOct 29, 2026ThemeREX Nuts DeserializationCVE-2026-62006Unauthenticated PHP Object Injection in Nuts <= 1.12 versions.
- 9.8CriticalOct 29, 2026ThemeREX Muzicon DeserializationCVE-2026-62005Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.
- 9.8CriticalOct 29, 2026ThemeREX Motorix DeserializationCVE-2026-62004Unauthenticated PHP Object Injection in Motorix <= 1.11 versions.
- 9.8CriticalOct 29, 2026ThemeREX Mission DeserializationCVE-2026-62003Unauthenticated PHP Object Injection in Mission <= 1.22 versions.
- 9.8CriticalOct 29, 2026ThemeREX Meals & Wheels DeserializationCVE-2026-62002Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions.
- 9.8CriticalOct 29, 2026ThemeREX Marcell DeserializationCVE-2026-62001Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.
- 9.8CriticalOct 29, 2026ThemeREX Le Truffe DeserializationCVE-2026-61998Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions.
- 9.8CriticalOct 29, 2026ThemeREX Legal Stone DeserializationCVE-2026-61997Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions.
- 9.8CriticalOct 29, 2026ThemeREX Ozisti DeserializationCVE-2026-54860Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions.
- 9.8CriticalOct 29, 2026ThemeREX Preservation DeserializationCVE-2026-54859Unauthenticated PHP Object Injection in Preservation <= 1.15 versions.
- 9.8CriticalOct 29, 2026ThemeREX Printy DeserializationCVE-2026-54858Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions.
- 9.8CriticalOct 29, 2026ThemeREX Quirky DeserializationCVE-2026-54857Unauthenticated PHP Object Injection in Quirky <= 1.23 versions.
- 9.8CriticalOct 29, 2026ThemeREX RexCoin DeserializationCVE-2026-54856Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions.
- 9.8CriticalOct 23, 2026ThemeREX ZenSoul DeserializationCVE-2026-112847Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue affects ZenSoul: from n/a through 1.13.
- 9.8CriticalOct 10, 2026ThemeRex Buzz Stone | Magazine & Viral Blog WordPress Theme DeserializationCVE-2026-81797Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions.
- 9.8CriticalOct 10, 2026ThemeRex Photolia DeserializationCVE-2026-78535Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.
- 9.8CriticalOct 10, 2026ThemeREX Jacqueline DeserializationCVE-2026-78531Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.
- 9.8CriticalOct 10, 2026ThemeREX Alliance DeserializationCVE-2026-78529Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.
- 9.8CriticalOct 10, 2026ThemeREX ShiftCV DeserializationCVE-2026-66564Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.
- 9.8CriticalOct 10, 2026ThemeREX Windsor DeserializationCVE-2026-66563Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.
- 9.8CriticalOct 10, 2026ThemeREX Education Center DeserializationCVE-2026-66483Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions.
- 9.8CriticalOct 10, 2026ThemeREX Asia Garden DeserializationCVE-2026-62125Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions.
- 9.8CriticalOct 10, 2026ThemeREX N7 | Golf Club Sports & Events DeserializationCVE-2026-62124Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions.
- 9.8CriticalOct 10, 2026ThemeREX Invetex DeserializationCVE-2026-62123Unauthenticated PHP Object Injection in Invetex <= 2.18 versions.
- 9.8CriticalOct 10, 2026ThemeREX Law Office DeserializationCVE-2026-62120Unauthenticated PHP Object Injection in Law Office <= 3.20 versions.
- 9.8CriticalOct 10, 2026ThemeREX WineShop DeserializationCVE-2026-62090Unauthenticated PHP Object Injection in WineShop <= 3.20 versions.
- 9.8CriticalOct 10, 2026ThemeREX Equadio DeserializationCVE-2026-62087Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions.
- 9.8CriticalOct 10, 2026ThemeREX Juno DeserializationCVE-2026-62086Unauthenticated PHP Object Injection in Juno <= 2.25 versions.
- 8.1HighOct 10, 2026ThemeREX Ozeum Path traversal / file handlingCVE-2026-62074Unauthenticated Local File Inclusion in Ozeum <= 1.3.0 versions.
- 9.8CriticalOct 10, 2026ThemeREX Yacht Rental DeserializationCVE-2026-62054Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions.
- 9.8CriticalOct 10, 2026ThemeREX Wine House DeserializationCVE-2026-62053Unauthenticated PHP Object Injection in Wine House <= 3.20 versions.
- 9.8CriticalOct 10, 2026ThemeREX Tipsy DeserializationCVE-2026-62052Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions.
- 9.8CriticalOct 10, 2026ThemeREX Stargaze DeserializationCVE-2026-62051Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions.
- 9.8CriticalOct 10, 2026ThemeREX Splendour DeserializationCVE-2026-62050Unauthenticated PHP Object Injection in Splendour <= 1.23 versions.
- 7.1HighOct 9, 2026ThemeREX Education Center XSSCVE-2026-94063Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Education Center education allows Reflected XSS.This issue affects Education Center: from n/a through 3.6.12.
- 6.5MediumSep 30, 2026ThemeREX Addons XSSCVE-2026-97236Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.
- 7.1HighSep 30, 2026ThemeREX Addons XSSCVE-2026-97235Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.
- 9.8CriticalSep 11, 2026ThemeREX Addons DeserializationCVE-2026-62105Unauthenticated PHP Object Injection in ThemeREX Addons < 2.45.0 versions.
Top products
- ThemeREX Addons3 CVEs in the last year, 1 critical
- Education Center2 CVEs in the last year, 1 critical
- ZenSoul1 CVE in the last year, 1 critical
- Yacht Rental1 CVE in the last year, 1 critical
- WineShop1 CVE in the last year, 1 critical
- Wine House1 CVE in the last year, 1 critical
- Windsor1 CVE in the last year, 1 critical
- Tipsy1 CVE in the last year, 1 critical
- Stargaze1 CVE in the last year, 1 critical
- Splendour1 CVE in the last year, 1 critical
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.
