Read the docs
TI-2020-08268 Aliases CVE-2020-10257GHSA-x679-h3r8-6399

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the…

Priority MEDIUM 54CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass, Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-862 and CWE-94.

Summary

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe sc parameter.

Why it matters now

EPSS 0.08877 95th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 103

CPEVersionsRoleVendor
cpe:2.3:a:themerex:addons:1.70.3:*:*:*:*:wordpress:*:*1.70.3VulnerableThemeREX
cpe:2.3:a:themerex:ozeum-museum:*:*:*:*:*:wordpress:*:*before 1.0.2VulnerableThemeREX
cpe:2.3:a:themerex:chit_club-board_games:*:*:*:*:*:wordpress:*:*before 1.0.1VulnerableThemeREX
cpe:2.3:a:themerex:addons:1.6.67:*:*:*:*:wordpress:*:*1.6.67VulnerableThemeREX
cpe:2.3:a:themerex:yottis-simple_portfolio:*:*:*:*:*:wordpress:*:*before 1.0.1VulnerableThemeREX
cpe:2.3:a:themerex:addons:1.6.66:*:*:*:*:wordpress:*:*1.6.66VulnerableThemeREX
cpe:2.3:a:themerex:helion-agency_\&portfolio:*:*:*:*:*:wordpress:*:*before 1.0.3VulnerableThemeREX
cpe:2.3:a:themerex:amuli:*:*:*:*:*:wordpress:*:*before 1.0.2VulnerableThemeREX
cpe:2.3:a:themerex:addons:1.6.65:*:*:*:*:wordpress:*:*1.6.65VulnerableThemeREX
cpe:2.3:a:themerex:nelson-barbershop_\+_tattoo_salon:*:*:*:*:*:wordpress:*:*before 1.0.1.2001VulnerableThemeREX
  • cpe:2.3:a:themerex:addons:1.70.3:*:*:*:*:wordpress:*:* Versions 1.70.3 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:ozeum-museum:*:*:*:*:*:wordpress:*:* Versions before 1.0.2 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:chit_club-board_games:*:*:*:*:*:wordpress:*:* Versions before 1.0.1 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:addons:1.6.67:*:*:*:*:wordpress:*:* Versions 1.6.67 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:yottis-simple_portfolio:*:*:*:*:*:wordpress:*:* Versions before 1.0.1 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:addons:1.6.66:*:*:*:*:wordpress:*:* Versions 1.6.66 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:helion-agency_\&portfolio:*:*:*:*:*:wordpress:*:* Versions before 1.0.3 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:amuli:*:*:*:*:*:wordpress:*:* Versions before 1.0.2 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:addons:1.6.65:*:*:*:*:wordpress:*:* Versions 1.6.65 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:nelson-barbershop_\+_tattoo_salon:*:*:*:*:*:wordpress:*:* Versions before 1.0.1.2001 Vulnerable ·ThemeREX
Show 93 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:themerex:hallelujah-church:*:*:*:*:*:wordpress:*:*before 1.0.1VulnerableThemeREX
cpe:2.3:a:themerex:right_way:*:*:*:*:*:wordpress:*:*before 4.0.1VulnerableThemeREX
cpe:2.3:a:themerex:prider-pride_fest:*:*:*:*:*:wordpress:*:*before 1.0.2VulnerableThemeREX
cpe:2.3:a:themerex:addons:1.6.62.3:*:*:*:*:wordpress:*:*1.6.62.3VulnerableThemeREX
cpe:2.3:a:themerex:mystik-esoterics:*:*:*:*:*:wordpress:*:*before 1.0.1VulnerableThemeREX
cpe:2.3:a:themerex:skydiving_and_flying_company:*:*:*:*:*:wordpress:*:*before 1.0.1VulnerableThemeREX
cpe:2.3:a:themerex:addons:1.6.62.1:*:*:*:*:wordpress:*:*1.6.62.1VulnerableThemeREX
cpe:2.3:a:themerex:dronex-aerial_photography_services:*:*:*:*:*:wordpress:*:*before 1.1.2001VulnerableThemeREX
cpe:2.3:a:themerex:addons:1.6.61.2:*:*:*:*:wordpress:*:*1.6.61.2VulnerableThemeREX
cpe:2.3:a:themerex:samadhi-buddhist:*:*:*:*:*:wordpress:*:*before 1.0.1VulnerableThemeREX
cpe:2.3:a:themerex:addons:1.6.61.3:*:*:*:*:wordpress:*:*1.6.61.3VulnerableThemeREX
cpe:2.3:a:themerex:tantum-rent_a_car\,_rent_a_bike\,_rent_a_scooter_multiskin_theme:*:*:*:*:*:wordpress:*:*before 1.0.2VulnerableThemeREX
cpe:2.3:a:themerex:scientia-public_library:*:*:*:*:*:wordpress:*:*before 1.0.1VulnerableThemeREX
cpe:2.3:a:themerex:blabber:*:*:*:*:*:wordpress:*:*before 1.5.2009VulnerableThemeREX
cpe:2.3:a:themerex:addons:1.6.61.1:*:*:*:*:wordpress:*:*1.6.61.1VulnerableThemeREX
cpe:2.3:a:themerex:impacto_patronus_multi-landing:*:*:*:*:*:wordpress:*:*before 1.1.2001VulnerableThemeREX
cpe:2.3:a:themerex:addons:1.6.61:*:*:*:*:wordpress:*:*1.6.61VulnerableThemeREX
cpe:2.3:a:themerex:rare_radio:*:*:*:*:*:wordpress:*:*before 1.0.1VulnerableThemeREX
cpe:2.3:a:themerex:addons:1.6.60:*:*:*:*:wordpress:*:*1.6.60VulnerableThemeREX
cpe:2.3:a:themerex:piqes-creative_startup_\&_agency_wordpress_theme:*:*:*:*:*:wordpress:*:*before 1.0.1VulnerableThemeREX
cpe:2.3:a:themerex:addons:1.6.59.3:*:*:*:*:wordpress:*:*1.6.59.3VulnerableThemeREX
cpe:2.3:a:themerex:kratz-digital_agency:*:*:*:*:*:wordpress:*:*before 1.0.2VulnerableThemeREX
cpe:2.3:a:themerex:addons:1.6.59.2:*:*:*:*:wordpress:*:*1.6.59.2VulnerableThemeREX
cpe:2.3:a:themerex:pixefy:*:*:*:*:*:wordpress:*:*before 1.0.1VulnerableThemeREX
cpe:2.3:a:themerex:addons:1.6.59.1.1:*:*:*:*:wordpress:*:*1.6.59.1.1VulnerableThemeREX
cpe:2.3:a:themerex:netmix-broadband_\&_telecom:*:*:*:*:*:wordpress:*:*before 1.0.2VulnerableThemeREX
cpe:2.3:a:themerex:addons:1.6.59:*:*:*:*:wordpress:*:*1.6.59VulnerableThemeREX
cpe:2.3:a:themerex:kids_care:*:*:*:*:*:wordpress:*:*before 3.0.5VulnerableThemeREX
cpe:2.3:a:themerex:addons:1.6.58.2:*:*:*:*:wordpress:*:*1.6.58.2VulnerableThemeREX
cpe:2.3:a:themerex:briny-diving_wordpress_theme:*:*:*:*:*:wordpress:*:*before 1.2.2000VulnerableThemeREX
cpe:2.3:a:themerex:addons:1.6.57.3:*:*:*:*:wordpress:*:*1.6.57.3VulnerableThemeREX
cpe:2.3:a:themerex:tornados:*:*:*:*:*:wordpress:*:*before 1.1.2001VulnerableThemeREX
cpe:2.3:a:themerex:addons:1.6.57.4:*:*:*:*:wordpress:*:*1.6.57.4VulnerableThemeREX
cpe:2.3:a:themerex:gridiron:*:*:*:*:*:wordpress:*:*before 1.0.2VulnerableThemeREX
cpe:2.3:a:themerex:addons:1.6.57.2:*:*:*:*:wordpress:*:*1.6.57.2VulnerableThemeREX
cpe:2.3:a:themerex:yungen-digital\/marketing_agency:*:*:*:*:*:wordpress:*:*before 1.0.1VulnerableThemeREX
cpe:2.3:a:themerex:fc_united-football:*:*:*:*:*:wordpress:*:*before 1.0.7VulnerableThemeREX
cpe:2.3:a:themerex:bugster-pests_control:*:*:*:*:*:wordpress:*:*before 1.0.2VulnerableThemeREX
cpe:2.3:a:themerex:addons:1.6.57:*:*:*:*:wordpress:*:*1.6.57VulnerableThemeREX
cpe:2.3:a:themerex:rumble-single_fighter_boxer\,_news\,_gym\,_store:*:*:*:*:*:wordpress:*:*before 1.0.4VulnerableThemeREX
cpe:2.3:a:themerex:addons:1.6.56:*:*:*:*:wordpress:*:*1.6.56VulnerableThemeREX
cpe:2.3:a:themerex:tacticool-shooting_range_wordpress_theme:*:*:*:*:*:wordpress:*:*before 1.0.1VulnerableThemeREX
cpe:2.3:a:themerex:addons:1.6.55.4:*:*:*:*:wordpress:*:*1.6.55.4VulnerableThemeREX
cpe:2.3:a:themerex:coinpress-cryptocurrency_magazine_\&_blog_wordpress_theme:*:*:*:*:*:wordpress:*:*before 1.0.2VulnerableThemeREX
cpe:2.3:a:themerex:addons:1.6.55.7:*:*:*:*:wordpress:*:*1.6.55.7VulnerableThemeREX
cpe:2.3:a:themerex:vihara-ashram\,_buddhist:*:*:*:*:*:wordpress:*:*before 1.1.2001VulnerableThemeREX
cpe:2.3:a:themerex:addons:1.6.55.3:*:*:*:*:wordpress:*:*1.6.55.3VulnerableThemeREX
cpe:2.3:a:themerex:katelyn-gutenberg_wordpress_blog_theme:*:*:*:*:*:wordpress:*:*before 1.0.4VulnerableThemeREX
cpe:2.3:a:themerex:addons:1.6.55.1:*:*:*:*:wordpress:*:*1.6.55.1VulnerableThemeREX
cpe:2.3:a:themerex:heaven_11-multiskin_property_theme:*:*:*:*:*:wordpress:*:*before 1.0.2VulnerableThemeREX
cpe:2.3:a:themerex:addons:1.6.54:*:*:*:*:wordpress:*:*1.6.54VulnerableThemeREX
cpe:2.3:a:themerex:especio-food_gutenberg_theme:*:*:*:*:*:wordpress:*:*before 1.0.1VulnerableThemeREX
cpe:2.3:a:themerex:addons:1.6.53.1:*:*:*:*:wordpress:*:*1.6.53.1VulnerableThemeREX
cpe:2.3:a:themerex:partiso_electioncampaign:*:*:*:*:*:wordpress:*:*before 1.1.2002VulnerableThemeREX
cpe:2.3:a:themerex:addons:1.6.53.3:*:*:*:*:wordpress:*:*1.6.53.3VulnerableThemeREX
cpe:2.3:a:themerex:kargo-freight_transport:*:*:*:*:*:wordpress:*:*before 1.1.2004VulnerableThemeREX
cpe:2.3:a:themerex:addons:1.6.53.2:*:*:*:*:wordpress:*:*1.6.53.2VulnerableThemeREX
cpe:2.3:a:themerex:maxify-startup_blog:*:*:*:*:*:wordpress:*:*before 1.0.4VulnerableThemeREX
cpe:2.3:a:themerex:lingvico-language_learning_school:*:*:*:*:*:wordpress:*:*before 1.0.3VulnerableThemeREX
cpe:2.3:a:themerex:aldo-gutenberg_wordpress_blog_theme:*:*:*:*:*:wordpress:*:*before 1.0.2VulnerableThemeREX
cpe:2.3:a:themerex:addons:1.6.52.2:*:*:*:*:wordpress:*:*1.6.52.2VulnerableThemeREX
cpe:2.3:a:themerex:vixus-startup_\/_mobile_application:*:*:*:*:*:wordpress:*:*before 1.0.4VulnerableThemeREX
cpe:2.3:a:themerex:addons:1.6.52.1:*:*:*:*:wordpress:*:*1.6.52.1VulnerableThemeREX
cpe:2.3:a:themerex:wellspring_water_filter_systems:*:*:*:*:*:wordpress:*:*before 1.0.3VulnerableThemeREX
cpe:2.3:a:themerex:nazareth-church:*:*:*:*:*:wordpress:*:*before 1.0.5VulnerableThemeREX
cpe:2.3:a:themerex:addons:1.6.53:*:*:*:*:wordpress:*:*1.6.53VulnerableThemeREX
cpe:2.3:a:themerex:tediss-soft_play_area\,_cafe_\&_child_care_center:*:*:*:*:*:wordpress:*:*before 1.0.3VulnerableThemeREX
cpe:2.3:a:themerex:addons:1.6.51.3:*:*:*:*:wordpress:*:*1.6.51.3VulnerableThemeREX
cpe:2.3:a:themerex:yolox-startup_magazine_\&_blog_wordpress_theme:*:*:*:*:*:wordpress:*:*before 1.0.3VulnerableThemeREX
cpe:2.3:a:themerex:meals_and_wheels-food_truck:*:*:*:*:*:wordpress:*:*before 1.0.3VulnerableThemeREX
cpe:2.3:a:themerex:addons:1.6.51.1:*:*:*:*:wordpress:*:*1.6.51.1VulnerableThemeREX
cpe:2.3:a:themerex:rosalinda-vegetarian_\&_health_coach:*:*:*:*:*:wordpress:*:*before 1.0.3VulnerableThemeREX
cpe:2.3:a:themerex:addons:1.6.50:*:*:*:*:wordpress:*:*1.6.50VulnerableThemeREX
cpe:2.3:a:themerex:vapester:*:*:*:*:*:wordpress:*:*before 1.1.2001VulnerableThemeREX
cpe:2.3:a:themerex:modern_housewife-housewife_and_family_blog:*:*:*:*:*:wordpress:*:*before 1.0.2VulnerableThemeREX
cpe:2.3:a:themerex:addons:1.6.50.1:*:*:*:*:wordpress:*:*1.6.50.1VulnerableThemeREX
cpe:2.3:a:themerex:chainpress:*:*:*:*:*:wordpress:*:*before 1.0.3VulnerableThemeREX
cpe:2.3:a:themerex:justitia-multiskin_lawyer_theme:*:*:*:*:*:wordpress:*:*before 1.0.3VulnerableThemeREX
cpe:2.3:a:themerex:hobo_digital_nomad_blog:*:*:*:*:*:wordpress:*:*before 1.0.3VulnerableThemeREX
cpe:2.3:a:themerex:rhodos-creative_corporate_wordpress_theme:*:*:*:*:*:wordpress:*:*before 1.3.2001VulnerableThemeREX
cpe:2.3:a:themerex:buzz_stone-magazine_\&_blog:*:*:*:*:*:wordpress:*:*before 1.0.3VulnerableThemeREX
cpe:2.3:a:themerex:addons:1.0.49.10:*:*:*:*:wordpress:*:*1.0.49.10VulnerableThemeREX
cpe:2.3:a:themerex:corredo_sport_event:*:*:*:*:*:wordpress:*:*before 1.1.2003VulnerableThemeREX
cpe:2.3:a:themerex:addons:1.6.49.8:*:*:*:*:wordpress:*:*1.6.49.8VulnerableThemeREX
cpe:2.3:a:themerex:savejulia_personal_fundraising_campaign:*:*:*:*:*:wordpress:*:*before 1.0.3VulnerableThemeREX
cpe:2.3:a:themerex:addons:1.6.49.6:*:*:*:*:wordpress:*:*1.6.49.6VulnerableThemeREX
cpe:2.3:a:themerex:bonkozoo_zoo:*:*:*:*:*:wordpress:*:*before 1.0.3VulnerableThemeREX
cpe:2.3:a:themerex:addons:1.6.49.6.2:*:*:*:*:wordpress:*:*1.6.49.6.2VulnerableThemeREX
cpe:2.3:a:themerex:renewal-plastic_surgeon_clinic:*:*:*:*:*:wordpress:*:*before 1.0.3VulnerableThemeREX
cpe:2.3:a:themerex:addons:1.6.49.5:*:*:*:*:wordpress:*:*1.6.49.5VulnerableThemeREX
cpe:2.3:a:themerex:gloss_blog:*:*:*:*:*:wordpress:*:*before 1.0.1VulnerableThemeREX
cpe:2.3:a:themerex:plumbing-repair\,_building_\&_construction_wordpress_theme:*:*:*:*:*:wordpress:*:*before 3.0.1VulnerableThemeREX
cpe:2.3:a:themerex:topper_theme_and_skins:-:*:*:*:*:wordpress:*:*not specified by NVDVulnerableThemeREX
  • cpe:2.3:a:themerex:hallelujah-church:*:*:*:*:*:wordpress:*:* Versions before 1.0.1 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:right_way:*:*:*:*:*:wordpress:*:* Versions before 4.0.1 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:prider-pride_fest:*:*:*:*:*:wordpress:*:* Versions before 1.0.2 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:addons:1.6.62.3:*:*:*:*:wordpress:*:* Versions 1.6.62.3 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:mystik-esoterics:*:*:*:*:*:wordpress:*:* Versions before 1.0.1 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:skydiving_and_flying_company:*:*:*:*:*:wordpress:*:* Versions before 1.0.1 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:addons:1.6.62.1:*:*:*:*:wordpress:*:* Versions 1.6.62.1 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:dronex-aerial_photography_services:*:*:*:*:*:wordpress:*:* Versions before 1.1.2001 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:addons:1.6.61.2:*:*:*:*:wordpress:*:* Versions 1.6.61.2 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:samadhi-buddhist:*:*:*:*:*:wordpress:*:* Versions before 1.0.1 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:addons:1.6.61.3:*:*:*:*:wordpress:*:* Versions 1.6.61.3 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:tantum-rent_a_car\,_rent_a_bike\,_rent_a_scooter_multiskin_theme:*:*:*:*:*:wordpress:*:* Versions before 1.0.2 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:scientia-public_library:*:*:*:*:*:wordpress:*:* Versions before 1.0.1 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:blabber:*:*:*:*:*:wordpress:*:* Versions before 1.5.2009 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:addons:1.6.61.1:*:*:*:*:wordpress:*:* Versions 1.6.61.1 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:impacto_patronus_multi-landing:*:*:*:*:*:wordpress:*:* Versions before 1.1.2001 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:addons:1.6.61:*:*:*:*:wordpress:*:* Versions 1.6.61 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:rare_radio:*:*:*:*:*:wordpress:*:* Versions before 1.0.1 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:addons:1.6.60:*:*:*:*:wordpress:*:* Versions 1.6.60 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:piqes-creative_startup_\&_agency_wordpress_theme:*:*:*:*:*:wordpress:*:* Versions before 1.0.1 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:addons:1.6.59.3:*:*:*:*:wordpress:*:* Versions 1.6.59.3 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:kratz-digital_agency:*:*:*:*:*:wordpress:*:* Versions before 1.0.2 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:addons:1.6.59.2:*:*:*:*:wordpress:*:* Versions 1.6.59.2 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:pixefy:*:*:*:*:*:wordpress:*:* Versions before 1.0.1 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:addons:1.6.59.1.1:*:*:*:*:wordpress:*:* Versions 1.6.59.1.1 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:netmix-broadband_\&_telecom:*:*:*:*:*:wordpress:*:* Versions before 1.0.2 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:addons:1.6.59:*:*:*:*:wordpress:*:* Versions 1.6.59 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:kids_care:*:*:*:*:*:wordpress:*:* Versions before 3.0.5 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:addons:1.6.58.2:*:*:*:*:wordpress:*:* Versions 1.6.58.2 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:briny-diving_wordpress_theme:*:*:*:*:*:wordpress:*:* Versions before 1.2.2000 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:addons:1.6.57.3:*:*:*:*:wordpress:*:* Versions 1.6.57.3 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:tornados:*:*:*:*:*:wordpress:*:* Versions before 1.1.2001 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:addons:1.6.57.4:*:*:*:*:wordpress:*:* Versions 1.6.57.4 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:gridiron:*:*:*:*:*:wordpress:*:* Versions before 1.0.2 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:addons:1.6.57.2:*:*:*:*:wordpress:*:* Versions 1.6.57.2 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:yungen-digital\/marketing_agency:*:*:*:*:*:wordpress:*:* Versions before 1.0.1 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:fc_united-football:*:*:*:*:*:wordpress:*:* Versions before 1.0.7 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:bugster-pests_control:*:*:*:*:*:wordpress:*:* Versions before 1.0.2 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:addons:1.6.57:*:*:*:*:wordpress:*:* Versions 1.6.57 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:rumble-single_fighter_boxer\,_news\,_gym\,_store:*:*:*:*:*:wordpress:*:* Versions before 1.0.4 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:addons:1.6.56:*:*:*:*:wordpress:*:* Versions 1.6.56 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:tacticool-shooting_range_wordpress_theme:*:*:*:*:*:wordpress:*:* Versions before 1.0.1 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:addons:1.6.55.4:*:*:*:*:wordpress:*:* Versions 1.6.55.4 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:coinpress-cryptocurrency_magazine_\&_blog_wordpress_theme:*:*:*:*:*:wordpress:*:* Versions before 1.0.2 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:addons:1.6.55.7:*:*:*:*:wordpress:*:* Versions 1.6.55.7 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:vihara-ashram\,_buddhist:*:*:*:*:*:wordpress:*:* Versions before 1.1.2001 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:addons:1.6.55.3:*:*:*:*:wordpress:*:* Versions 1.6.55.3 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:katelyn-gutenberg_wordpress_blog_theme:*:*:*:*:*:wordpress:*:* Versions before 1.0.4 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:addons:1.6.55.1:*:*:*:*:wordpress:*:* Versions 1.6.55.1 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:heaven_11-multiskin_property_theme:*:*:*:*:*:wordpress:*:* Versions before 1.0.2 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:addons:1.6.54:*:*:*:*:wordpress:*:* Versions 1.6.54 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:especio-food_gutenberg_theme:*:*:*:*:*:wordpress:*:* Versions before 1.0.1 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:addons:1.6.53.1:*:*:*:*:wordpress:*:* Versions 1.6.53.1 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:partiso_electioncampaign:*:*:*:*:*:wordpress:*:* Versions before 1.1.2002 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:addons:1.6.53.3:*:*:*:*:wordpress:*:* Versions 1.6.53.3 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:kargo-freight_transport:*:*:*:*:*:wordpress:*:* Versions before 1.1.2004 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:addons:1.6.53.2:*:*:*:*:wordpress:*:* Versions 1.6.53.2 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:maxify-startup_blog:*:*:*:*:*:wordpress:*:* Versions before 1.0.4 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:lingvico-language_learning_school:*:*:*:*:*:wordpress:*:* Versions before 1.0.3 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:aldo-gutenberg_wordpress_blog_theme:*:*:*:*:*:wordpress:*:* Versions before 1.0.2 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:addons:1.6.52.2:*:*:*:*:wordpress:*:* Versions 1.6.52.2 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:vixus-startup_\/_mobile_application:*:*:*:*:*:wordpress:*:* Versions before 1.0.4 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:addons:1.6.52.1:*:*:*:*:wordpress:*:* Versions 1.6.52.1 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:wellspring_water_filter_systems:*:*:*:*:*:wordpress:*:* Versions before 1.0.3 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:nazareth-church:*:*:*:*:*:wordpress:*:* Versions before 1.0.5 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:addons:1.6.53:*:*:*:*:wordpress:*:* Versions 1.6.53 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:tediss-soft_play_area\,_cafe_\&_child_care_center:*:*:*:*:*:wordpress:*:* Versions before 1.0.3 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:addons:1.6.51.3:*:*:*:*:wordpress:*:* Versions 1.6.51.3 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:yolox-startup_magazine_\&_blog_wordpress_theme:*:*:*:*:*:wordpress:*:* Versions before 1.0.3 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:meals_and_wheels-food_truck:*:*:*:*:*:wordpress:*:* Versions before 1.0.3 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:addons:1.6.51.1:*:*:*:*:wordpress:*:* Versions 1.6.51.1 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:rosalinda-vegetarian_\&_health_coach:*:*:*:*:*:wordpress:*:* Versions before 1.0.3 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:addons:1.6.50:*:*:*:*:wordpress:*:* Versions 1.6.50 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:vapester:*:*:*:*:*:wordpress:*:* Versions before 1.1.2001 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:modern_housewife-housewife_and_family_blog:*:*:*:*:*:wordpress:*:* Versions before 1.0.2 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:addons:1.6.50.1:*:*:*:*:wordpress:*:* Versions 1.6.50.1 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:chainpress:*:*:*:*:*:wordpress:*:* Versions before 1.0.3 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:justitia-multiskin_lawyer_theme:*:*:*:*:*:wordpress:*:* Versions before 1.0.3 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:hobo_digital_nomad_blog:*:*:*:*:*:wordpress:*:* Versions before 1.0.3 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:rhodos-creative_corporate_wordpress_theme:*:*:*:*:*:wordpress:*:* Versions before 1.3.2001 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:buzz_stone-magazine_\&_blog:*:*:*:*:*:wordpress:*:* Versions before 1.0.3 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:addons:1.0.49.10:*:*:*:*:wordpress:*:* Versions 1.0.49.10 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:corredo_sport_event:*:*:*:*:*:wordpress:*:* Versions before 1.1.2003 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:addons:1.6.49.8:*:*:*:*:wordpress:*:* Versions 1.6.49.8 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:savejulia_personal_fundraising_campaign:*:*:*:*:*:wordpress:*:* Versions before 1.0.3 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:addons:1.6.49.6:*:*:*:*:wordpress:*:* Versions 1.6.49.6 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:bonkozoo_zoo:*:*:*:*:*:wordpress:*:* Versions before 1.0.3 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:addons:1.6.49.6.2:*:*:*:*:wordpress:*:* Versions 1.6.49.6.2 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:renewal-plastic_surgeon_clinic:*:*:*:*:*:wordpress:*:* Versions before 1.0.3 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:addons:1.6.49.5:*:*:*:*:wordpress:*:* Versions 1.6.49.5 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:gloss_blog:*:*:*:*:*:wordpress:*:* Versions before 1.0.1 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:plumbing-repair\,_building_\&_construction_wordpress_theme:*:*:*:*:*:wordpress:*:* Versions before 3.0.1 Vulnerable ·ThemeREX
  • cpe:2.3:a:themerex:topper_theme_and_skins:-:*:*:*:*:wordpress:*:* Versions not specified by NVD Vulnerable ·ThemeREX

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-10257
  2. 2026-10-03 Alias added: GHSA-x679-h3r8-6399

References

Exploit 1

  • TI-2024-12489 ThemeREX Addons <= 2.32.3 - Unauthenticated Arbitrary File Upload in trx_addons_uploads_save_data CVSS 3.1CRITICAL 9.8
  • TI-2025-00576 ThemeREX Addons <= 2.33.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode CVSS 3.1HIGH 8.8
  • TI-2025-06364 Cross-site scripting in ThemeREX Addons CVSS 3.1MEDIUM 6.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences