[ Vendor · 23 CVEs ]
ThemeREX
CVEs affecting ThemeREX published in the last 30 days, plus any ThemeREX CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-78535 | 10 Oct 2026 | CVSS 9.8 | ThemeRex PhotoliaUnauthenticated PHP Object Injection in Photolia <= 1.0.3 versions. | |
| CVE-2026-81797 | 10 Oct 2026 | CVSS 9.8 | ThemeRex Buzz Stone | Magazine & Viral Blog WordPress ThemeUnauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions. | |
| CVE-2026-78529 | 10 Oct 2026 | CVSS 9.8 | ThemeREX AllianceUnauthenticated PHP Object Injection in Alliance <= 3.11 versions. | |
| CVE-2026-78531 | 10 Oct 2026 | CVSS 9.8 | ThemeREX JacquelineUnauthenticated PHP Object Injection in Jacqueline <= 2.22 versions. | |
| CVE-2026-66483 | 10 Oct 2026 | CVSS 9.8 | ThemeREX Education CenterUnauthenticated PHP Object Injection in Education Center <= 3.6.12 versions. | |
| CVE-2026-66563 | 10 Oct 2026 | CVSS 9.8 | ThemeREX WindsorUnauthenticated PHP Object Injection in Windsor <= 2.10 versions. | |
| CVE-2026-66564 | 10 Oct 2026 | CVSS 9.8 | ThemeREX ShiftCVUnauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions. | |
| CVE-2026-62120 | 10 Oct 2026 | CVSS 9.8 | ThemeREX Law OfficeUnauthenticated PHP Object Injection in Law Office <= 3.20 versions. | |
| CVE-2026-62123 | 10 Oct 2026 | CVSS 9.8 | ThemeREX InvetexUnauthenticated PHP Object Injection in Invetex <= 2.18 versions. | |
| CVE-2026-62124 | 10 Oct 2026 | CVSS 9.8 | ThemeREX N7 | Golf Club Sports & EventsUnauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions. | |
| CVE-2026-62125 | 10 Oct 2026 | CVSS 9.8 | ThemeREX Asia GardenUnauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions. | |
| CVE-2026-62086 | 10 Oct 2026 | CVSS 9.8 | ThemeREX JunoUnauthenticated PHP Object Injection in Juno <= 2.25 versions. | |
| CVE-2026-62087 | 10 Oct 2026 | CVSS 9.8 | ThemeREX EquadioUnauthenticated PHP Object Injection in Equadio <= 1.1.4 versions. | |
| CVE-2026-62090 | 10 Oct 2026 | CVSS 9.8 | ThemeREX WineShopUnauthenticated PHP Object Injection in WineShop <= 3.20 versions. | |
| CVE-2026-62074 | 10 Oct 2026 | CVSS 8.1 | ThemeREX OzeumUnauthenticated Local File Inclusion in Ozeum <= 1.3.0 versions. | |
| CVE-2026-62050 | 10 Oct 2026 | CVSS 9.8 | ThemeREX SplendourUnauthenticated PHP Object Injection in Splendour <= 1.23 versions. | |
| CVE-2026-62051 | 10 Oct 2026 | CVSS 9.8 | ThemeREX StargazeUnauthenticated PHP Object Injection in Stargaze <= 1.10 versions. | |
| CVE-2026-62052 | 10 Oct 2026 | CVSS 9.8 | ThemeREX TipsyUnauthenticated PHP Object Injection in Tipsy <= 1.6 versions. | |
| CVE-2026-62053 | 10 Oct 2026 | CVSS 9.8 | ThemeREX Wine HouseUnauthenticated PHP Object Injection in Wine House <= 3.20 versions. | |
| CVE-2026-62054 | 10 Oct 2026 | CVSS 9.8 | ThemeREX Yacht RentalUnauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions. | |
| CVE-2026-94063 | 9 Oct 2026 | CVSS 7.1 | ThemeREX Education CenterImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Education Center education allows… | |
| CVE-2026-97235 | 30 Sep 2026 | CVSS 7.1 | ThemeREX AddonsUnauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions. | |
| CVE-2026-97236 | 30 Sep 2026 | CVSS 6.5 | ThemeREX AddonsSubscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions. |