Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

29 records

Vendor: ThemeREX Group Clear all filters
TI-2026-79732 CVE-2026-112846 · GHSA-3cwm-hcqf-g7j5

PHP object injection in WordPress Save Life theme

Priority MEDIUM 49

Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life: from n/a through 1.2.14.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00313 Published 2026-10-23 No fix listed CWE-502
TI-2026-79737 CVE-2026-112851 · GHSA-qgpf-hhcm-qq72

PHP object injection in ThemeREX HotLock WordPress theme

Priority MEDIUM 49

Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This issue affects HotLock: from n/a through 1.3.9.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00313 Published 2026-10-23 No fix listed CWE-502
TI-2026-79738 CVE-2026-112852 · GHSA-6p2h-2hxg-g4q7

PHP object injection in ThemeREX Helion WordPress theme

Priority LOW 37

Deserialization of Untrusted Data vulnerability in ThemeREX Group Helion helion allows Object Injection.This issue affects Helion: from n/a through 1.1.12.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00257 Published 2026-10-23 No fix listed CWE-502
TI-2026-79742 CVE-2026-112856 · GHSA-7846-572j-93wr

PHP object injection in WordPress Vagabonds theme

Priority MEDIUM 49

Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds: from n/a through 1.3.10.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00313 Published 2026-10-23 No fix listed CWE-502
TI-2026-79745 CVE-2026-112859 · GHSA-8xhm-xwwm-cmm8

Object injection in ThemeREX Little Birdies WordPress theme

Priority MEDIUM 49

Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects Little Birdies: from n/a through 1.3.16.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00313 Published 2026-10-23 No fix listed CWE-502
TI-2026-70366 CVE-2026-57742 · GHSA-j947-jvf8-j6qh

Reflected cross-site scripting in ThemeREX Kids Planet theme

Priority LOW 30

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group Kids Planet allows Reflected XSS.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00142 Published 2026-10-10 No fix listed CWE-79
TI-2026-70153 CVE-2026-62045 · GHSA-5vfq-q3vw-rcg2

PHP object injection in WordPress Booklovers theme

Priority MEDIUM 49

Deserialization of Untrusted Data vulnerability in ThemeREX Group Booklovers booklovers allows Object Injection.This issue affects Booklovers: from n/a through 2.13.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00311 Published 2026-10-10 No fix listed CWE-502
TI-2026-70154 CVE-2026-62046 · GHSA-grw9-6gf5-p4rx

PHP object injection in WordPress Gutentype theme

Priority MEDIUM 49

Deserialization of Untrusted Data vulnerability in ThemeREX Group Gutentype gutentype allows Object Injection.This issue affects Gutentype: from n/a through 2.1.12.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00311 Published 2026-10-10 No fix listed CWE-502
TI-2026-70189 CVE-2026-93944 · GHSA-6c7p-2q6j-98g8

PHP object injection in WordPress Camelia theme

Priority MEDIUM 49

Deserialization of Untrusted Data vulnerability in ThemeREX Group Camelia camelia allows Object Injection.This issue affects Camelia: from n/a through 1.2.15.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00322 Published 2026-10-10 No fix listed CWE-502
TI-2026-70188 CVE-2026-93943 · GHSA-x739-mm79-x5pj

PHP object injection in WordPress Convex theme

Priority MEDIUM 49

Deserialization of Untrusted Data vulnerability in ThemeREX Group Convex convex allows Object Injection.This issue affects Convex: from n/a through 1.16.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00322 Published 2026-10-10 No fix listed CWE-502
TI-2026-70187 CVE-2026-93942 · GHSA-jr82-xf5g-vmwf

PHP object injection in ThemeREX Dwell WordPress theme

Priority MEDIUM 49

Deserialization of Untrusted Data vulnerability in ThemeREX Group Dwell dwell allows Object Injection.This issue affects Dwell: from n/a through 1.16.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00322 Published 2026-10-10 No fix listed CWE-502
TI-2026-70186 CVE-2026-93941 · GHSA-66j7-cgjc-vfw6

PHP object injection in ThemeREX Edema WordPress theme

Priority MEDIUM 49

Deserialization of Untrusted Data vulnerability in ThemeREX Group Edema edema allows Object Injection.This issue affects Edema: from n/a through 1.2.2.2.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00322 Published 2026-10-10 No fix listed CWE-502
TI-2026-70185 CVE-2026-93940 · GHSA-qw9w-57w4-24pf

PHP object injection in WordPress Greeny theme

Priority MEDIUM 49

Deserialization of Untrusted Data vulnerability in ThemeREX Group Greeny greeny allows Object Injection.This issue affects Greeny: from n/a through 2.10.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00322 Published 2026-10-10 No fix listed CWE-502
TI-2026-70184 CVE-2026-93938 · GHSA-g3qq-hrvj-4p9x

PHP object injection in WordPress Hogwords theme

Priority MEDIUM 49

Deserialization of Untrusted Data vulnerability in ThemeREX Group Hogwords hogwords allows Object Injection.This issue affects Hogwords: from n/a through 1.2.7.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00322 Published 2026-10-10 No fix listed CWE-502
TI-2026-70183 CVE-2026-93937 · GHSA-7ghx-gjh7-w66h

PHP object injection in WordPress Hygia theme by ThemeREX

Priority MEDIUM 49

Deserialization of Untrusted Data vulnerability in ThemeREX Group Hygia hygia allows Object Injection.This issue affects Hygia: from n/a through 1.21.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00322 Published 2026-10-10 No fix listed CWE-502
TI-2026-70182 CVE-2026-93936 · GHSA-5p9m-cj8c-rf88

PHP object injection in WordPress IPharm theme

Priority MEDIUM 49

Deserialization of Untrusted Data vulnerability in ThemeREX Group IPharm ipharm allows Object Injection.This issue affects IPharm: from n/a through 1.2.4.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00322 Published 2026-10-10 No fix listed CWE-502
TI-2026-70181 CVE-2026-93935 · GHSA-36px-f35p-pgp6

PHP object injection in WordPress Let's Play theme

Priority MEDIUM 49

Deserialization of Untrusted Data vulnerability in ThemeREX Group Let's Play playhockey allows Object Injection.This issue affects Let's Play: from n/a through 1.1.15.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00304 Published 2026-10-10 No fix listed CWE-502
TI-2026-70180 CVE-2026-93934 · GHSA-jgqf-fvm7-46rr

PHP object injection in WordPress Partiso theme

Priority MEDIUM 49

Deserialization of Untrusted Data vulnerability in ThemeREX Group Partiso partiso allows Object Injection.This issue affects Partiso: from n/a through 1.1.13.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00304 Published 2026-10-10 No fix listed CWE-502
TI-2026-70179 CVE-2026-93933 · GHSA-fgvq-8q7m-978c

PHP object injection in WordPress Rosalinda theme

Priority MEDIUM 49

Deserialization of Untrusted Data vulnerability in ThemeREX Group Rosalinda rosalinda allows Object Injection.This issue affects Rosalinda: from n/a through 1.2.4.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00304 Published 2026-10-10 No fix listed CWE-502
TI-2026-70178 CVE-2026-93932 · GHSA-h2fc-7wx7-m9pr

PHP object injection in WordPress Smart Casa theme

Priority MEDIUM 49

Deserialization of Untrusted Data vulnerability in ThemeREX Group Smart Casa smart-casa allows Object Injection.This issue affects Smart Casa: from n/a through 1.0.12.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00304 Published 2026-10-10 No fix listed CWE-502
TI-2026-70177 CVE-2026-93931 · GHSA-g269-mqp5-x3j6

PHP object injection in WordPress Smash theme

Priority MEDIUM 49

Deserialization of Untrusted Data vulnerability in ThemeREX Group Smash smash allows Object Injection.This issue affects Smash: from n/a through 1.12.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00304 Published 2026-10-10 No fix listed CWE-502
TI-2026-70176 CVE-2026-93930 · GHSA-mff3-g5xq-9hwm

PHP object injection in WordPress Tantra theme

Priority MEDIUM 49

Deserialization of Untrusted Data vulnerability in ThemeREX Group Tantra tantra allows Object Injection.This issue affects Tantra: from n/a through 2.9.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00304 Published 2026-10-10 No fix listed CWE-502
TI-2026-70175 CVE-2026-93929 · GHSA-qr7g-mmgw-6fp4

PHP object injection in WordPress Travesia theme

Priority MEDIUM 49

Deserialization of Untrusted Data vulnerability in ThemeREX Group Travesia travesia allows Object Injection.This issue affects Travesia: from n/a through 1.1.16.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00311 Published 2026-10-10 No fix listed CWE-502
TI-2026-66013 CVE-2026-102798 · GHSA-vp8m-3vgx-w255

WordPress ThemeREX Addons plugin <= 2.46.0 - Cross Site Scripting (XSS) vulnerability

Priority LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Stored XSS.This issue affects ThemeREX Addons: from n/a through 2.46.…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00127 Published 2026-10-02 No fix listed CWE-79
Load more