Read the docs

ThemeREX Group

Records29All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical23CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9

Exploited now

ThemeREX Group records in CISA KEV

No ThemeREX Group vulnerabilities are listed in CISA KEV.

Records

29 records

TI-2026-79745 CVE-2026-112859 · GHSA-8xhm-xwwm-cmm8

Object injection in ThemeREX Little Birdies WordPress theme

Priority MEDIUM 49

Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects Little Birdies: from n/a through 1.3.16.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00313 Published 2026-10-23 No fix listed CWE-502
TI-2026-79742 CVE-2026-112856 · GHSA-7846-572j-93wr

PHP object injection in WordPress Vagabonds theme

Priority MEDIUM 49

Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds: from n/a through 1.3.10.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00313 Published 2026-10-23 No fix listed CWE-502
TI-2026-79737 CVE-2026-112851 · GHSA-qgpf-hhcm-qq72

PHP object injection in ThemeREX HotLock WordPress theme

Priority MEDIUM 49

Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This issue affects HotLock: from n/a through 1.3.9.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00313 Published 2026-10-23 No fix listed CWE-502
TI-2026-79732 CVE-2026-112846 · GHSA-3cwm-hcqf-g7j5

PHP object injection in WordPress Save Life theme

Priority MEDIUM 49

Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life: from n/a through 1.2.14.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00313 Published 2026-10-23 No fix listed CWE-502
TI-2026-70189 CVE-2026-93944 · GHSA-6c7p-2q6j-98g8

PHP object injection in WordPress Camelia theme

Priority MEDIUM 49

Deserialization of Untrusted Data vulnerability in ThemeREX Group Camelia camelia allows Object Injection.This issue affects Camelia: from n/a through 1.2.15.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00322 Published 2026-10-10 No fix listed CWE-502
TI-2026-70188 CVE-2026-93943 · GHSA-x739-mm79-x5pj

PHP object injection in WordPress Convex theme

Priority MEDIUM 49

Deserialization of Untrusted Data vulnerability in ThemeREX Group Convex convex allows Object Injection.This issue affects Convex: from n/a through 1.16.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00322 Published 2026-10-10 No fix listed CWE-502
TI-2026-70187 CVE-2026-93942 · GHSA-jr82-xf5g-vmwf

PHP object injection in ThemeREX Dwell WordPress theme

Priority MEDIUM 49

Deserialization of Untrusted Data vulnerability in ThemeREX Group Dwell dwell allows Object Injection.This issue affects Dwell: from n/a through 1.16.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00322 Published 2026-10-10 No fix listed CWE-502
TI-2026-70186 CVE-2026-93941 · GHSA-66j7-cgjc-vfw6

PHP object injection in ThemeREX Edema WordPress theme

Priority MEDIUM 49

Deserialization of Untrusted Data vulnerability in ThemeREX Group Edema edema allows Object Injection.This issue affects Edema: from n/a through 1.2.2.2.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00322 Published 2026-10-10 No fix listed CWE-502
TI-2026-70185 CVE-2026-93940 · GHSA-qw9w-57w4-24pf

PHP object injection in WordPress Greeny theme

Priority MEDIUM 49

Deserialization of Untrusted Data vulnerability in ThemeREX Group Greeny greeny allows Object Injection.This issue affects Greeny: from n/a through 2.10.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00322 Published 2026-10-10 No fix listed CWE-502
TI-2026-70184 CVE-2026-93938 · GHSA-g3qq-hrvj-4p9x

PHP object injection in WordPress Hogwords theme

Priority MEDIUM 49

Deserialization of Untrusted Data vulnerability in ThemeREX Group Hogwords hogwords allows Object Injection.This issue affects Hogwords: from n/a through 1.2.7.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00322 Published 2026-10-10 No fix listed CWE-502
TI-2026-70183 CVE-2026-93937 · GHSA-7ghx-gjh7-w66h

PHP object injection in WordPress Hygia theme by ThemeREX

Priority MEDIUM 49

Deserialization of Untrusted Data vulnerability in ThemeREX Group Hygia hygia allows Object Injection.This issue affects Hygia: from n/a through 1.21.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00322 Published 2026-10-10 No fix listed CWE-502
TI-2026-70182 CVE-2026-93936 · GHSA-5p9m-cj8c-rf88

PHP object injection in WordPress IPharm theme

Priority MEDIUM 49

Deserialization of Untrusted Data vulnerability in ThemeREX Group IPharm ipharm allows Object Injection.This issue affects IPharm: from n/a through 1.2.4.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00322 Published 2026-10-10 No fix listed CWE-502
TI-2026-70181 CVE-2026-93935 · GHSA-36px-f35p-pgp6

PHP object injection in WordPress Let's Play theme

Priority MEDIUM 49

Deserialization of Untrusted Data vulnerability in ThemeREX Group Let's Play playhockey allows Object Injection.This issue affects Let's Play: from n/a through 1.1.15.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00304 Published 2026-10-10 No fix listed CWE-502
TI-2026-70180 CVE-2026-93934 · GHSA-jgqf-fvm7-46rr

PHP object injection in WordPress Partiso theme

Priority MEDIUM 49

Deserialization of Untrusted Data vulnerability in ThemeREX Group Partiso partiso allows Object Injection.This issue affects Partiso: from n/a through 1.1.13.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00304 Published 2026-10-10 No fix listed CWE-502
TI-2026-70179 CVE-2026-93933 · GHSA-fgvq-8q7m-978c

PHP object injection in WordPress Rosalinda theme

Priority MEDIUM 49

Deserialization of Untrusted Data vulnerability in ThemeREX Group Rosalinda rosalinda allows Object Injection.This issue affects Rosalinda: from n/a through 1.2.4.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00304 Published 2026-10-10 No fix listed CWE-502
TI-2026-70178 CVE-2026-93932 · GHSA-h2fc-7wx7-m9pr

PHP object injection in WordPress Smart Casa theme

Priority MEDIUM 49

Deserialization of Untrusted Data vulnerability in ThemeREX Group Smart Casa smart-casa allows Object Injection.This issue affects Smart Casa: from n/a through 1.0.12.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00304 Published 2026-10-10 No fix listed CWE-502
TI-2026-70177 CVE-2026-93931 · GHSA-g269-mqp5-x3j6

PHP object injection in WordPress Smash theme

Priority MEDIUM 49

Deserialization of Untrusted Data vulnerability in ThemeREX Group Smash smash allows Object Injection.This issue affects Smash: from n/a through 1.12.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00304 Published 2026-10-10 No fix listed CWE-502
TI-2026-70176 CVE-2026-93930 · GHSA-mff3-g5xq-9hwm

PHP object injection in WordPress Tantra theme

Priority MEDIUM 49

Deserialization of Untrusted Data vulnerability in ThemeREX Group Tantra tantra allows Object Injection.This issue affects Tantra: from n/a through 2.9.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00304 Published 2026-10-10 No fix listed CWE-502
TI-2026-70175 CVE-2026-93929 · GHSA-qr7g-mmgw-6fp4

PHP object injection in WordPress Travesia theme

Priority MEDIUM 49

Deserialization of Untrusted Data vulnerability in ThemeREX Group Travesia travesia allows Object Injection.This issue affects Travesia: from n/a through 1.1.16.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00311 Published 2026-10-10 No fix listed CWE-502
TI-2026-70154 CVE-2026-62046 · GHSA-grw9-6gf5-p4rx

PHP object injection in WordPress Gutentype theme

Priority MEDIUM 49

Deserialization of Untrusted Data vulnerability in ThemeREX Group Gutentype gutentype allows Object Injection.This issue affects Gutentype: from n/a through 2.1.12.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00311 Published 2026-10-10 No fix listed CWE-502
TI-2026-70153 CVE-2026-62045 · GHSA-5vfq-q3vw-rcg2

PHP object injection in WordPress Booklovers theme

Priority MEDIUM 49

Deserialization of Untrusted Data vulnerability in ThemeREX Group Booklovers booklovers allows Object Injection.This issue affects Booklovers: from n/a through 2.13.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00311 Published 2026-10-10 No fix listed CWE-502
Load more
Open these records in search →