# cve.now: Themerex Group

The newest entries naming Themerex Group as an affected vendor (up to 200), of 29 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-112846](https://cve.now/CVE-2026-112846.md): WordPress Save Life theme \<= 1.2.14 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-112851](https://cve.now/CVE-2026-112851.md): WordPress HotLock theme \<= 1.3.9 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-112852](https://cve.now/CVE-2026-112852.md): WordPress Helion theme \<= 1.1.12 - PHP Object Injection vulnerability (CVSS 8.1)
- [CVE-2026-112856](https://cve.now/CVE-2026-112856.md): WordPress Vagabonds theme \<= 1.3.10 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-112859](https://cve.now/CVE-2026-112859.md): WordPress Little Birdies theme \<= 1.3.16 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-57742](https://cve.now/CVE-2026-57742.md): WordPress Kids Planet theme \<= 2.2.14.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-62045](https://cve.now/CVE-2026-62045.md): WordPress Booklovers theme \<= 2.13.0 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-62046](https://cve.now/CVE-2026-62046.md): WordPress Gutentype theme \<= 2.1.12 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-93944](https://cve.now/CVE-2026-93944.md): WordPress Camelia theme \<= 1.2.15 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-93943](https://cve.now/CVE-2026-93943.md): WordPress Convex theme \<= 1.16.0 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-93942](https://cve.now/CVE-2026-93942.md): WordPress Dwell theme \<= 1.16.0 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-93941](https://cve.now/CVE-2026-93941.md): WordPress Edema theme \<= 1.2.2.2 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-93940](https://cve.now/CVE-2026-93940.md): WordPress Greeny theme \<= 2.10.0 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-93938](https://cve.now/CVE-2026-93938.md): WordPress Hogwords theme \<= 1.2.7 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-93937](https://cve.now/CVE-2026-93937.md): WordPress Hygia theme \<= 1.21.0 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-93936](https://cve.now/CVE-2026-93936.md): WordPress IPharm theme \<= 1.2.4 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-93935](https://cve.now/CVE-2026-93935.md): WordPress Let's Play theme \<= 1.1.15 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-93934](https://cve.now/CVE-2026-93934.md): WordPress Partiso theme \<= 1.1.13 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-93933](https://cve.now/CVE-2026-93933.md): WordPress Rosalinda theme \<= 1.2.4 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-93932](https://cve.now/CVE-2026-93932.md): WordPress Smart Casa theme \<= 1.0.12 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-93931](https://cve.now/CVE-2026-93931.md): WordPress Smash theme \<= 1.12.0 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-93930](https://cve.now/CVE-2026-93930.md): WordPress Tantra theme \<= 2.9.0 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-93929](https://cve.now/CVE-2026-93929.md): WordPress Travesia theme \<= 1.1.16 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-102797](https://cve.now/CVE-2026-102797.md): WordPress ThemeREX Addons plugin \<= 2.46.0 - Server Side Request Forgery (SSRF) vulnerability (CVSS 6.4)
- [CVE-2026-102798](https://cve.now/CVE-2026-102798.md): WordPress ThemeREX Addons plugin \<= 2.46.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-60205](https://cve.now/CVE-2025-60205.md): WordPress ThemeREX Addons plugin \<= 2.36.1.1 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-39529](https://cve.now/CVE-2026-39529.md): WordPress Elementra theme \<= 1.0.9 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2025-60085](https://cve.now/CVE-2025-60085.md): WordPress Learnify theme \<= 1.15.0 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2025-58924](https://cve.now/CVE-2025-58924.md): WordPress Geya theme \<= 1.15 - Local File Inclusion vulnerability (CVSS 8.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/themerex-group
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.