Themerex vulnerabilities
236 CVEs and advisories name Themerex as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-22453WordPress Pets Club theme <= 2.3 - PHP Object Injection vulnerability
- CVE-2026-22452WordPress Hoverex theme <= 1.5.10 - Local File Inclusion vulnerability
- CVE-2026-22443WordPress Alliance theme <= 3.1.1 - Local File Inclusion vulnerability
- CVE-2025-54001WordPress Classter theme <= 2.5 - PHP Object Injection vulnerability
- CVE-2025-53335WordPress Berger theme <= 1.1.1 - Local File Inclusion vulnerability
- CVE-2025-69406WordPress FreightCo theme <= 1.1.7 - Local File Inclusion vulnerability
- CVE-2025-69405WordPress Lorem Ipsum | Books & Media Store theme <= 1.2.11 - PHP Object Injection vulnerability
- CVE-2025-69404WordPress Extreme Store theme <= 1.5.10 - PHP Object Injection vulnerability
- CVE-2025-69402WordPress R&F theme <= 1.5 - Local File Inclusion vulnerability
- CVE-2025-69400WordPress Yokoo theme <= 1.1.11 - Local File Inclusion vulnerability
- CVE-2025-69399WordPress Cobble theme <= 1.7 - Local File Inclusion vulnerability
- CVE-2025-69398WordPress Plank theme <= 1.7 - Local File Inclusion vulnerability
- CVE-2025-69397WordPress Tint theme <= 1.7 - Local File Inclusion vulnerability
- CVE-2025-69396WordPress Splendour theme <= 1.23 - Local File Inclusion vulnerability
- CVE-2025-69395WordPress Gable theme <= 1.5 - Local File Inclusion vulnerability
- CVE-2025-69079WordPress Sound | Musical Instruments Online Store theme <= 1.6.9 - Deserialization of untrusted data vulnerability
- CVE-2025-69081WordPress Hope theme <= 3.0.0 - Local File Inclusion vulnerability
- CVE-2025-49890WordPress Organic Beauty Theme <= 1.4.6 - PHP Object Injection Vulnerability
- CVE-2025-6997ThemeREX Addons <= 2.35.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via trx_addons_get_svg_from_file Function
- CVE-2024-13786Education Center | LMS & Online Courses WordPress Theme <= 3.6.10 - PHP Object Injection
- CVE-2024-13770Puzzles | WP Magazine / Review with Store WordPress Theme + RTL <= 4.2.4 - Unauthenticated PHP Object Injection
- CVE-2025-0837Puzzles <= 4.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2024-13769Puzzles | WP Magazine / Review with Store WordPress Theme + RTL <= 4.2.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
- CVE-2024-13448ThemeREX Addons <= 2.32.3 - Unauthenticated Arbitrary File Upload in trx_addons_uploads_save_data
- CVE-2025-0682ThemeREX Addons <= 2.33.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode
- CVE-2024-6297Several WordPress.org Plugins <= Various Versions - Injected Backdoor