Priority MEDIUM 54
The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because includes/plugin.rest-…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.08877 · Published 2020-03-09 · No fix listed CWE-862
Priority MEDIUM 51
The ThemeREX Addons plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'trx_addons_uploads_save_data' function in all versions up to, and including, 2.32.3.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00915 · Published 2025-01-28 · No fix listed CWE-434
Priority MEDIUM 51
Several plugins for WordPress hosted on WordPress.org have been compromised and injected with malicious PHP scripts.
CVSS 3.1CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.01011 · Published 2024-06-25 · No fix listed
Priority MEDIUM 50
Unauthenticated PHP Object Injection in FreightCo <= 1.1.15 versions.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00564 · Published 2026-08-24 · No fix listed CWE-502
Priority MEDIUM 50
Unauthenticated PHP Object Injection in Abelle <= 1.22 versions.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00564 · Published 2026-08-06 · No fix listed CWE-502
Priority MEDIUM 50
Unauthenticated PHP Object Injection in ThemeREX Addons < 2.45.0 versions.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00564 · Published 2026-09-11 · Fixed in 2.45.0 CWE-502
Priority MEDIUM 50
Deserialization of Untrusted Data vulnerability in ThemeREX Solaris solaris allows Object Injection.This issue affects Solaris: from n/a through <= 2.5.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00606 · Published 2026-03-05 · No fix listed CWE-502
Priority MEDIUM 50
Deserialization of Untrusted Data vulnerability in ThemeREX Pets Club petclub allows Object Injection.This issue affects Pets Club: from n/a through <= 2.3.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00606 · Published 2026-03-05 · No fix listed CWE-502
Priority MEDIUM 50
Deserialization of Untrusted Data vulnerability in ThemeREX Classter classter allows Object Injection.This issue affects Classter: from n/a through <= 2.5.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00606 · Published 2026-03-05 · No fix listed CWE-502
Priority MEDIUM 50
The education theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.6.10 via deserialization of untrusted input in the 'themerex_callback_view_more_posts' function.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.006 · Published 2025-07-02 · No fix listed CWE-502
Priority MEDIUM 49
Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00408 · Published 2026-10-30 · No fix listed CWE-502
Priority MEDIUM 49
Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00449 · Published 2026-10-29 · No fix listed CWE-502
Priority MEDIUM 49
Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00419 · Published 2026-10-29 · No fix listed CWE-502
Priority MEDIUM 49
Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00396 · Published 2026-10-29 · No fix listed CWE-502
Priority MEDIUM 49
Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00396 · Published 2026-10-29 · No fix listed CWE-502
Priority MEDIUM 49
Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00425 · Published 2026-10-29 · No fix listed CWE-502
Priority MEDIUM 49
Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00449 · Published 2026-10-29 · No fix listed CWE-502
Priority MEDIUM 49
Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00419 · Published 2026-10-29 · No fix listed CWE-502
Priority MEDIUM 49
Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00396 · Published 2026-10-29 · No fix listed CWE-502
Priority MEDIUM 49
Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00396 · Published 2026-10-29 · No fix listed CWE-502
Priority MEDIUM 49
Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00425 · Published 2026-10-29 · No fix listed CWE-502
Priority MEDIUM 49
Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00419 · Published 2026-10-29 · No fix listed CWE-502
Priority MEDIUM 49
Unauthenticated PHP Object Injection in Nuts <= 1.12 versions.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00419 · Published 2026-10-29 · No fix listed CWE-502
Priority MEDIUM 49
Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00396 · Published 2026-10-29 · No fix listed CWE-502
Priority MEDIUM 49
Unauthenticated PHP Object Injection in Motorix <= 1.11 versions.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00396 · Published 2026-10-29 · No fix listed CWE-502
Load more
THREATIST.IORead the docs