{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: ThemeREX vulnerabilities","home_page_url":"https://patchfirst.co/vendor/themerex/","feed_url":"https://patchfirst.co/feed/vendor/themerex.json","description":"New and newly exploited ThemeREX CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-119526","url":"https://patchfirst.co/cve/CVE-2026-119526/","title":"CVE-2026-119526: Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection","content_text":"ThemeREX · Royal Event. Not in CISA KEV. No EPSS score. CVSS 9.8 CRITICAL. Priority 6.9 of 100.","summary":"Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection","date_published":"2026-10-30T00:00:00.000Z","date_modified":"2026-10-30T19:22:27.000Z","tags":[],"_patchfirst":{"reason":"published","priority":6.9,"kev":null,"epss":null,"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ThemeREX","product":"Royal Event","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-54859","url":"https://patchfirst.co/cve/CVE-2026-54859/","title":"CVE-2026-54859: Unauthenticated PHP Object Injection in Preservation <= 1.15 versions","content_text":"ThemeREX · Preservation. Not in CISA KEV. EPSS 0.5% (higher than 44.6% of CVEs). CVSS 9.8 CRITICAL. Priority 16.5 of 100.","summary":"Unauthenticated PHP Object Injection in Preservation <= 1.15 versions","date_published":"2026-10-29T00:00:00.000Z","date_modified":"2026-10-29T20:17:31.000Z","tags":[],"_patchfirst":{"reason":"published","priority":16.5,"kev":null,"epss":{"score":0.00526,"percentile":0.44563},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ThemeREX","product":"Preservation","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-62002","url":"https://patchfirst.co/cve/CVE-2026-62002/","title":"CVE-2026-62002: Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions","content_text":"ThemeREX · Meals & Wheels. Not in CISA KEV. EPSS 0.5% (higher than 43.6% of CVEs). CVSS 9.8 CRITICAL. Priority 16.3 of 100.","summary":"Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions","date_published":"2026-10-29T00:00:00.000Z","date_modified":"2026-10-29T20:17:31.000Z","tags":[],"_patchfirst":{"reason":"published","priority":16.3,"kev":null,"epss":{"score":0.00511,"percentile":0.43565},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ThemeREX","product":"Meals & Wheels","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-61997","url":"https://patchfirst.co/cve/CVE-2026-61997/","title":"CVE-2026-61997: Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions","content_text":"ThemeREX · Legal Stone. Not in CISA KEV. EPSS 0.5% (higher than 43.6% of CVEs). CVSS 9.8 CRITICAL. Priority 16.3 of 100.","summary":"Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions","date_published":"2026-10-29T00:00:00.000Z","date_modified":"2026-10-30T19:18:29.000Z","tags":[],"_patchfirst":{"reason":"published","priority":16.3,"kev":null,"epss":{"score":0.00511,"percentile":0.43565},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ThemeREX","product":"Legal Stone","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-54860","url":"https://patchfirst.co/cve/CVE-2026-54860/","title":"CVE-2026-54860: Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions","content_text":"ThemeREX · Ozisti. Not in CISA KEV. EPSS 0.5% (higher than 42.2% of CVEs). CVSS 9.8 CRITICAL. Priority 16.0 of 100.","summary":"Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions","date_published":"2026-10-29T00:00:00.000Z","date_modified":"2026-10-30T19:18:26.000Z","tags":[],"_patchfirst":{"reason":"published","priority":16,"kev":null,"epss":{"score":0.0049,"percentile":0.42158},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ThemeREX","product":"Ozisti","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-54858","url":"https://patchfirst.co/cve/CVE-2026-54858/","title":"CVE-2026-54858: Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions","content_text":"ThemeREX · Printy. Not in CISA KEV. EPSS 0.5% (higher than 42.2% of CVEs). CVSS 9.8 CRITICAL. Priority 16.0 of 100.","summary":"Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions","date_published":"2026-10-29T00:00:00.000Z","date_modified":"2026-10-29T18:17:33.000Z","tags":[],"_patchfirst":{"reason":"published","priority":16,"kev":null,"epss":{"score":0.0049,"percentile":0.42158},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ThemeREX","product":"Printy","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-54857","url":"https://patchfirst.co/cve/CVE-2026-54857/","title":"CVE-2026-54857: Unauthenticated PHP Object Injection in Quirky <= 1.23 versions","content_text":"ThemeREX · Quirky. Not in CISA KEV. EPSS 0.5% (higher than 42.2% of CVEs). CVSS 9.8 CRITICAL. Priority 16.0 of 100.","summary":"Unauthenticated PHP Object Injection in Quirky <= 1.23 versions","date_published":"2026-10-29T00:00:00.000Z","date_modified":"2026-10-30T19:18:26.000Z","tags":[],"_patchfirst":{"reason":"published","priority":16,"kev":null,"epss":{"score":0.0049,"percentile":0.42158},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ThemeREX","product":"Quirky","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-54856","url":"https://patchfirst.co/cve/CVE-2026-54856/","title":"CVE-2026-54856: Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions","content_text":"ThemeREX · RexCoin. Not in CISA KEV. EPSS 0.5% (higher than 42.2% of CVEs). CVSS 9.8 CRITICAL. Priority 16.0 of 100.","summary":"Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions","date_published":"2026-10-29T00:00:00.000Z","date_modified":"2026-10-30T19:18:26.000Z","tags":[],"_patchfirst":{"reason":"published","priority":16,"kev":null,"epss":{"score":0.0049,"percentile":0.42157},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ThemeREX","product":"RexCoin","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-62001","url":"https://patchfirst.co/cve/CVE-2026-62001/","title":"CVE-2026-62001: Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions","content_text":"ThemeREX · Marcell. Not in CISA KEV. EPSS 0.5% (higher than 41.1% of CVEs). CVSS 9.8 CRITICAL. Priority 15.8 of 100.","summary":"Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions","date_published":"2026-10-29T00:00:00.000Z","date_modified":"2026-10-29T18:17:34.000Z","tags":[],"_patchfirst":{"reason":"published","priority":15.8,"kev":null,"epss":{"score":0.00476,"percentile":0.41133},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ThemeREX","product":"Marcell","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-61998","url":"https://patchfirst.co/cve/CVE-2026-61998/","title":"CVE-2026-61998: Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions","content_text":"ThemeREX · Le Truffe. Not in CISA KEV. EPSS 0.5% (higher than 41.1% of CVEs). CVSS 9.8 CRITICAL. Priority 15.8 of 100.","summary":"Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions","date_published":"2026-10-29T00:00:00.000Z","date_modified":"2026-10-30T19:18:29.000Z","tags":[],"_patchfirst":{"reason":"published","priority":15.8,"kev":null,"epss":{"score":0.00476,"percentile":0.41133},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ThemeREX","product":"Le Truffe","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-62018","url":"https://patchfirst.co/cve/CVE-2026-62018/","title":"CVE-2026-62018: Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions","content_text":"ThemeREX · Gunslinger. Not in CISA KEV. EPSS 0.4% (higher than 39.1% of CVEs). CVSS 9.8 CRITICAL. Priority 15.4 of 100.","summary":"Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions","date_published":"2026-10-29T00:00:00.000Z","date_modified":"2026-10-29T20:17:32.000Z","tags":[],"_patchfirst":{"reason":"published","priority":15.4,"kev":null,"epss":{"score":0.00449,"percentile":0.39063},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ThemeREX","product":"Gunslinger","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-62013","url":"https://patchfirst.co/cve/CVE-2026-62013/","title":"CVE-2026-62013: Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions","content_text":"ThemeREX · Edge Decor. Not in CISA KEV. EPSS 0.4% (higher than 39.1% of CVEs). CVSS 9.8 CRITICAL. Priority 15.4 of 100.","summary":"Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions","date_published":"2026-10-29T00:00:00.000Z","date_modified":"2026-10-29T20:17:32.000Z","tags":[],"_patchfirst":{"reason":"published","priority":15.4,"kev":null,"epss":{"score":0.00449,"percentile":0.39063},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ThemeREX","product":"Edge Decor","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-62014","url":"https://patchfirst.co/cve/CVE-2026-62014/","title":"CVE-2026-62014: Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions","content_text":"ThemeREX · EmojiNation. Not in CISA KEV. EPSS 0.4% (higher than 36.8% of CVEs). CVSS 9.8 CRITICAL. Priority 14.9 of 100.","summary":"Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions","date_published":"2026-10-29T00:00:00.000Z","date_modified":"2026-10-30T19:18:30.000Z","tags":[],"_patchfirst":{"reason":"published","priority":14.9,"kev":null,"epss":{"score":0.00425,"percentile":0.3677},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ThemeREX","product":"EmojiNation","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-62009","url":"https://patchfirst.co/cve/CVE-2026-62009/","title":"CVE-2026-62009: Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions","content_text":"ThemeREX · Filmax. Not in CISA KEV. EPSS 0.4% (higher than 36.8% of CVEs). CVSS 9.8 CRITICAL. Priority 14.9 of 100.","summary":"Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions","date_published":"2026-10-29T00:00:00.000Z","date_modified":"2026-10-30T19:18:30.000Z","tags":[],"_patchfirst":{"reason":"published","priority":14.9,"kev":null,"epss":{"score":0.00425,"percentile":0.3677},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ThemeREX","product":"Filmax","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-62017","url":"https://patchfirst.co/cve/CVE-2026-62017/","title":"CVE-2026-62017: Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions","content_text":"ThemeREX · Good Homes. Not in CISA KEV. EPSS 0.4% (higher than 36.2% of CVEs). CVSS 9.8 CRITICAL. Priority 14.8 of 100.","summary":"Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions","date_published":"2026-10-29T00:00:00.000Z","date_modified":"2026-10-29T18:17:34.000Z","tags":[],"_patchfirst":{"reason":"published","priority":14.8,"kev":null,"epss":{"score":0.00419,"percentile":0.36207},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ThemeREX","product":"Good Homes","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-62012","url":"https://patchfirst.co/cve/CVE-2026-62012/","title":"CVE-2026-62012: Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions","content_text":"ThemeREX · Coinpress. Not in CISA KEV. EPSS 0.4% (higher than 36.2% of CVEs). CVSS 9.8 CRITICAL. Priority 14.8 of 100.","summary":"Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions","date_published":"2026-10-29T00:00:00.000Z","date_modified":"2026-10-29T18:17:34.000Z","tags":[],"_patchfirst":{"reason":"published","priority":14.8,"kev":null,"epss":{"score":0.00419,"percentile":0.36207},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ThemeREX","product":"Coinpress","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-62008","url":"https://patchfirst.co/cve/CVE-2026-62008/","title":"CVE-2026-62008: Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions","content_text":"ThemeREX · Orpheus. Not in CISA KEV. EPSS 0.4% (higher than 36.2% of CVEs). CVSS 9.8 CRITICAL. Priority 14.8 of 100.","summary":"Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions","date_published":"2026-10-29T00:00:00.000Z","date_modified":"2026-10-29T20:17:32.000Z","tags":[],"_patchfirst":{"reason":"published","priority":14.8,"kev":null,"epss":{"score":0.00419,"percentile":0.36208},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ThemeREX","product":"Orpheus","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-62006","url":"https://patchfirst.co/cve/CVE-2026-62006/","title":"CVE-2026-62006: Unauthenticated PHP Object Injection in Nuts <= 1.12 versions","content_text":"ThemeREX · Nuts. Not in CISA KEV. EPSS 0.4% (higher than 36.2% of CVEs). CVSS 9.8 CRITICAL. Priority 14.8 of 100.","summary":"Unauthenticated PHP Object Injection in Nuts <= 1.12 versions","date_published":"2026-10-29T00:00:00.000Z","date_modified":"2026-10-29T18:17:34.000Z","tags":[],"_patchfirst":{"reason":"published","priority":14.8,"kev":null,"epss":{"score":0.00419,"percentile":0.36208},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ThemeREX","product":"Nuts","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-62016","url":"https://patchfirst.co/cve/CVE-2026-62016/","title":"CVE-2026-62016: Unauthenticated PHP Object Injection in Gamic <= 1.19 versions","content_text":"ThemeREX · Gamic. Not in CISA KEV. EPSS 0.4% (higher than 33.8% of CVEs). CVSS 9.8 CRITICAL. Priority 14.3 of 100.","summary":"Unauthenticated PHP Object Injection in Gamic <= 1.19 versions","date_published":"2026-10-29T00:00:00.000Z","date_modified":"2026-10-30T19:18:31.000Z","tags":[],"_patchfirst":{"reason":"published","priority":14.3,"kev":null,"epss":{"score":0.00396,"percentile":0.33795},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ThemeREX","product":"Gamic","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-62015","url":"https://patchfirst.co/cve/CVE-2026-62015/","title":"CVE-2026-62015: Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions","content_text":"ThemeREX · Gamezone. Not in CISA KEV. EPSS 0.4% (higher than 33.8% of CVEs). CVSS 9.8 CRITICAL. Priority 14.3 of 100.","summary":"Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions","date_published":"2026-10-29T00:00:00.000Z","date_modified":"2026-10-30T19:18:31.000Z","tags":[],"_patchfirst":{"reason":"published","priority":14.3,"kev":null,"epss":{"score":0.00396,"percentile":0.33795},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ThemeREX","product":"Gamezone","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-62011","url":"https://patchfirst.co/cve/CVE-2026-62011/","title":"CVE-2026-62011: Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions","content_text":"ThemeREX · Bonbon. Not in CISA KEV. EPSS 0.4% (higher than 33.8% of CVEs). CVSS 9.8 CRITICAL. Priority 14.3 of 100.","summary":"Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions","date_published":"2026-10-29T00:00:00.000Z","date_modified":"2026-10-30T19:18:30.000Z","tags":[],"_patchfirst":{"reason":"published","priority":14.3,"kev":null,"epss":{"score":0.00396,"percentile":0.33794},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ThemeREX","product":"Bonbon","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-62010","url":"https://patchfirst.co/cve/CVE-2026-62010/","title":"CVE-2026-62010: Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions","content_text":"ThemeREX · Avventure. Not in CISA KEV. EPSS 0.4% (higher than 33.8% of CVEs). CVSS 9.8 CRITICAL. Priority 14.3 of 100.","summary":"Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions","date_published":"2026-10-29T00:00:00.000Z","date_modified":"2026-10-30T19:18:30.000Z","tags":[],"_patchfirst":{"reason":"published","priority":14.3,"kev":null,"epss":{"score":0.00396,"percentile":0.33795},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ThemeREX","product":"Avventure","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-62005","url":"https://patchfirst.co/cve/CVE-2026-62005/","title":"CVE-2026-62005: Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions","content_text":"ThemeREX · Muzicon. Not in CISA KEV. EPSS 0.4% (higher than 33.8% of CVEs). CVSS 9.8 CRITICAL. Priority 14.3 of 100.","summary":"Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions","date_published":"2026-10-29T00:00:00.000Z","date_modified":"2026-10-30T19:18:30.000Z","tags":[],"_patchfirst":{"reason":"published","priority":14.3,"kev":null,"epss":{"score":0.00396,"percentile":0.33794},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ThemeREX","product":"Muzicon","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-62004","url":"https://patchfirst.co/cve/CVE-2026-62004/","title":"CVE-2026-62004: Unauthenticated PHP Object Injection in Motorix <= 1.11 versions","content_text":"ThemeREX · Motorix. Not in CISA KEV. EPSS 0.4% (higher than 33.8% of CVEs). CVSS 9.8 CRITICAL. Priority 14.3 of 100.","summary":"Unauthenticated PHP Object Injection in Motorix <= 1.11 versions","date_published":"2026-10-29T00:00:00.000Z","date_modified":"2026-10-30T19:18:30.000Z","tags":[],"_patchfirst":{"reason":"published","priority":14.3,"kev":null,"epss":{"score":0.00396,"percentile":0.33794},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ThemeREX","product":"Motorix","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-62003","url":"https://patchfirst.co/cve/CVE-2026-62003/","title":"CVE-2026-62003: Unauthenticated PHP Object Injection in Mission <= 1.22 versions","content_text":"ThemeREX · Mission. Not in CISA KEV. EPSS 0.4% (higher than 33.8% of CVEs). CVSS 9.8 CRITICAL. Priority 14.3 of 100.","summary":"Unauthenticated PHP Object Injection in Mission <= 1.22 versions","date_published":"2026-10-29T00:00:00.000Z","date_modified":"2026-10-30T19:18:30.000Z","tags":[],"_patchfirst":{"reason":"published","priority":14.3,"kev":null,"epss":{"score":0.00396,"percentile":0.33795},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ThemeREX","product":"Mission","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-112847","url":"https://patchfirst.co/cve/CVE-2026-112847/","title":"CVE-2026-112847: Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue affects…","content_text":"ThemeREX · ZenSoul. Not in CISA KEV. EPSS 0.3% (higher than 24.3% of CVEs). CVSS 9.8 CRITICAL. Priority 13.5 of 100.","summary":"Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue affects…","date_published":"2026-10-23T00:00:00.000Z","date_modified":"2026-10-24T15:16:59.000Z","tags":[],"_patchfirst":{"reason":"published","priority":13.5,"kev":null,"epss":{"score":0.00313,"percentile":0.24265},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ThemeREX","product":"ZenSoul","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-62090","url":"https://patchfirst.co/cve/CVE-2026-62090/","title":"CVE-2026-62090: Unauthenticated PHP Object Injection in WineShop <= 3.20 versions","content_text":"ThemeREX · WineShop. Not in CISA KEV. EPSS 0.4% (higher than 31.5% of CVEs). CVSS 9.8 CRITICAL. Priority 15.5 of 100.","summary":"Unauthenticated PHP Object Injection in WineShop <= 3.20 versions","date_published":"2026-10-10T00:00:00.000Z","date_modified":"2026-10-13T13:28:15.000Z","tags":[],"_patchfirst":{"reason":"published","priority":15.5,"kev":null,"epss":{"score":0.00375,"percentile":0.31479},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ThemeREX","product":"WineShop","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-62087","url":"https://patchfirst.co/cve/CVE-2026-62087/","title":"CVE-2026-62087: Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions","content_text":"ThemeREX · Equadio. Not in CISA KEV. EPSS 0.4% (higher than 31.5% of CVEs). CVSS 9.8 CRITICAL. Priority 15.5 of 100.","summary":"Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions","date_published":"2026-10-10T00:00:00.000Z","date_modified":"2026-10-13T13:28:15.000Z","tags":[],"_patchfirst":{"reason":"published","priority":15.5,"kev":null,"epss":{"score":0.00375,"percentile":0.3148},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ThemeREX","product":"Equadio","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-62086","url":"https://patchfirst.co/cve/CVE-2026-62086/","title":"CVE-2026-62086: Unauthenticated PHP Object Injection in Juno <= 2.25 versions","content_text":"ThemeREX · Juno. Not in CISA KEV. EPSS 0.4% (higher than 31.5% of CVEs). CVSS 9.8 CRITICAL. Priority 15.5 of 100.","summary":"Unauthenticated PHP Object Injection in Juno <= 2.25 versions","date_published":"2026-10-10T00:00:00.000Z","date_modified":"2026-10-13T13:28:15.000Z","tags":[],"_patchfirst":{"reason":"published","priority":15.5,"kev":null,"epss":{"score":0.00375,"percentile":0.3148},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ThemeREX","product":"Juno","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-62054","url":"https://patchfirst.co/cve/CVE-2026-62054/","title":"CVE-2026-62054: Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions","content_text":"ThemeREX · Yacht Rental. Not in CISA KEV. EPSS 0.4% (higher than 31.5% of CVEs). CVSS 9.8 CRITICAL. Priority 15.5 of 100.","summary":"Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions","date_published":"2026-10-10T00:00:00.000Z","date_modified":"2026-10-13T13:28:15.000Z","tags":[],"_patchfirst":{"reason":"published","priority":15.5,"kev":null,"epss":{"score":0.00375,"percentile":0.31482},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ThemeREX","product":"Yacht Rental","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-62053","url":"https://patchfirst.co/cve/CVE-2026-62053/","title":"CVE-2026-62053: Unauthenticated PHP Object Injection in Wine House <= 3.20 versions","content_text":"ThemeREX · Wine House. Not in CISA KEV. EPSS 0.4% (higher than 31.5% of CVEs). CVSS 9.8 CRITICAL. Priority 15.5 of 100.","summary":"Unauthenticated PHP Object Injection in Wine House <= 3.20 versions","date_published":"2026-10-10T00:00:00.000Z","date_modified":"2026-10-13T13:28:15.000Z","tags":[],"_patchfirst":{"reason":"published","priority":15.5,"kev":null,"epss":{"score":0.00375,"percentile":0.31479},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ThemeREX","product":"Wine House","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-62052","url":"https://patchfirst.co/cve/CVE-2026-62052/","title":"CVE-2026-62052: Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions","content_text":"ThemeREX · Tipsy. Not in CISA KEV. EPSS 0.4% (higher than 31.5% of CVEs). CVSS 9.8 CRITICAL. Priority 15.5 of 100.","summary":"Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions","date_published":"2026-10-10T00:00:00.000Z","date_modified":"2026-10-13T13:28:15.000Z","tags":[],"_patchfirst":{"reason":"published","priority":15.5,"kev":null,"epss":{"score":0.00375,"percentile":0.31484},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ThemeREX","product":"Tipsy","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-62051","url":"https://patchfirst.co/cve/CVE-2026-62051/","title":"CVE-2026-62051: Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions","content_text":"ThemeREX · Stargaze. Not in CISA KEV. EPSS 0.4% (higher than 31.5% of CVEs). CVSS 9.8 CRITICAL. Priority 15.5 of 100.","summary":"Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions","date_published":"2026-10-10T00:00:00.000Z","date_modified":"2026-10-13T13:28:15.000Z","tags":[],"_patchfirst":{"reason":"published","priority":15.5,"kev":null,"epss":{"score":0.00375,"percentile":0.31482},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ThemeREX","product":"Stargaze","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-62050","url":"https://patchfirst.co/cve/CVE-2026-62050/","title":"CVE-2026-62050: Unauthenticated PHP Object Injection in Splendour <= 1.23 versions","content_text":"ThemeREX · Splendour. Not in CISA KEV. EPSS 0.4% (higher than 31.5% of CVEs). CVSS 9.8 CRITICAL. Priority 15.5 of 100.","summary":"Unauthenticated PHP Object Injection in Splendour <= 1.23 versions","date_published":"2026-10-10T00:00:00.000Z","date_modified":"2026-10-13T13:28:15.000Z","tags":[],"_patchfirst":{"reason":"published","priority":15.5,"kev":null,"epss":{"score":0.00375,"percentile":0.31483},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ThemeREX","product":"Splendour","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-78535","url":"https://patchfirst.co/cve/CVE-2026-78535/","title":"CVE-2026-78535: Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions","content_text":"ThemeRex · Photolia. Not in CISA KEV. EPSS 0.3% (higher than 26% of CVEs). CVSS 9.8 CRITICAL. Priority 14.4 of 100.","summary":"Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions","date_published":"2026-10-10T00:00:00.000Z","date_modified":"2026-10-13T13:29:12.000Z","tags":[],"_patchfirst":{"reason":"published","priority":14.4,"kev":null,"epss":{"score":0.00328,"percentile":0.25974},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ThemeRex","product":"Photolia","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-81797","url":"https://patchfirst.co/cve/CVE-2026-81797/","title":"CVE-2026-81797: Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions","content_text":"ThemeRex · Buzz Stone | Magazine & Viral Blog WordPress Theme. Not in CISA KEV. EPSS 0.3% (higher than 23.9% of CVEs). CVSS 9.8 CRITICAL. Priority 14.0 of 100.","summary":"Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions","date_published":"2026-10-10T00:00:00.000Z","date_modified":"2026-10-13T13:29:12.000Z","tags":[],"_patchfirst":{"reason":"published","priority":14,"kev":null,"epss":{"score":0.00311,"percentile":0.23948},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ThemeRex","product":"Buzz Stone | Magazine & Viral Blog WordPress Theme","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-78531","url":"https://patchfirst.co/cve/CVE-2026-78531/","title":"CVE-2026-78531: Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions","content_text":"ThemeREX · Jacqueline. Not in CISA KEV. EPSS 0.3% (higher than 23.2% of CVEs). CVSS 9.8 CRITICAL. Priority 13.9 of 100.","summary":"Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions","date_published":"2026-10-10T00:00:00.000Z","date_modified":"2026-10-13T13:29:12.000Z","tags":[],"_patchfirst":{"reason":"published","priority":13.9,"kev":null,"epss":{"score":0.00304,"percentile":0.23236},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ThemeREX","product":"Jacqueline","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-78529","url":"https://patchfirst.co/cve/CVE-2026-78529/","title":"CVE-2026-78529: Unauthenticated PHP Object Injection in Alliance <= 3.11 versions","content_text":"ThemeREX · Alliance. Not in CISA KEV. EPSS 0.3% (higher than 23.2% of CVEs). CVSS 9.8 CRITICAL. Priority 13.9 of 100.","summary":"Unauthenticated PHP Object Injection in Alliance <= 3.11 versions","date_published":"2026-10-10T00:00:00.000Z","date_modified":"2026-10-13T13:29:12.000Z","tags":[],"_patchfirst":{"reason":"published","priority":13.9,"kev":null,"epss":{"score":0.00304,"percentile":0.23231},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ThemeREX","product":"Alliance","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-66564","url":"https://patchfirst.co/cve/CVE-2026-66564/","title":"CVE-2026-66564: Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions","content_text":"ThemeREX · ShiftCV. Not in CISA KEV. EPSS 0.3% (higher than 23.2% of CVEs). CVSS 9.8 CRITICAL. Priority 13.9 of 100.","summary":"Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions","date_published":"2026-10-10T00:00:00.000Z","date_modified":"2026-10-13T13:28:15.000Z","tags":[],"_patchfirst":{"reason":"published","priority":13.9,"kev":null,"epss":{"score":0.00304,"percentile":0.23231},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ThemeREX","product":"ShiftCV","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-66563","url":"https://patchfirst.co/cve/CVE-2026-66563/","title":"CVE-2026-66563: Unauthenticated PHP Object Injection in Windsor <= 2.10 versions","content_text":"ThemeREX · Windsor. Not in CISA KEV. EPSS 0.3% (higher than 23.2% of CVEs). CVSS 9.8 CRITICAL. Priority 13.9 of 100.","summary":"Unauthenticated PHP Object Injection in Windsor <= 2.10 versions","date_published":"2026-10-10T00:00:00.000Z","date_modified":"2026-10-13T13:28:15.000Z","tags":[],"_patchfirst":{"reason":"published","priority":13.9,"kev":null,"epss":{"score":0.00304,"percentile":0.23236},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ThemeREX","product":"Windsor","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-66483","url":"https://patchfirst.co/cve/CVE-2026-66483/","title":"CVE-2026-66483: Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions","content_text":"ThemeREX · Education Center. Not in CISA KEV. EPSS 0.3% (higher than 23.2% of CVEs). CVSS 9.8 CRITICAL. Priority 13.9 of 100.","summary":"Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions","date_published":"2026-10-10T00:00:00.000Z","date_modified":"2026-10-13T13:28:15.000Z","tags":[],"_patchfirst":{"reason":"published","priority":13.9,"kev":null,"epss":{"score":0.00304,"percentile":0.23235},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ThemeREX","product":"Education Center","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-62125","url":"https://patchfirst.co/cve/CVE-2026-62125/","title":"CVE-2026-62125: Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions","content_text":"ThemeREX · Asia Garden. Not in CISA KEV. EPSS 0.3% (higher than 23.2% of CVEs). CVSS 9.8 CRITICAL. Priority 13.9 of 100.","summary":"Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions","date_published":"2026-10-10T00:00:00.000Z","date_modified":"2026-10-13T13:28:15.000Z","tags":[],"_patchfirst":{"reason":"published","priority":13.9,"kev":null,"epss":{"score":0.00304,"percentile":0.23232},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ThemeREX","product":"Asia Garden","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-62124","url":"https://patchfirst.co/cve/CVE-2026-62124/","title":"CVE-2026-62124: Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions","content_text":"ThemeREX · N7 | Golf Club Sports & Events. Not in CISA KEV. EPSS 0.3% (higher than 23.2% of CVEs). CVSS 9.8 CRITICAL. Priority 13.9 of 100.","summary":"Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions","date_published":"2026-10-10T00:00:00.000Z","date_modified":"2026-10-13T13:28:15.000Z","tags":[],"_patchfirst":{"reason":"published","priority":13.9,"kev":null,"epss":{"score":0.00304,"percentile":0.23233},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ThemeREX","product":"N7 | Golf Club Sports & Events","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-62123","url":"https://patchfirst.co/cve/CVE-2026-62123/","title":"CVE-2026-62123: Unauthenticated PHP Object Injection in Invetex <= 2.18 versions","content_text":"ThemeREX · Invetex. Not in CISA KEV. EPSS 0.3% (higher than 23.2% of CVEs). CVSS 9.8 CRITICAL. Priority 13.9 of 100.","summary":"Unauthenticated PHP Object Injection in Invetex <= 2.18 versions","date_published":"2026-10-10T00:00:00.000Z","date_modified":"2026-10-13T13:28:15.000Z","tags":[],"_patchfirst":{"reason":"published","priority":13.9,"kev":null,"epss":{"score":0.00304,"percentile":0.23233},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ThemeREX","product":"Invetex","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-62120","url":"https://patchfirst.co/cve/CVE-2026-62120/","title":"CVE-2026-62120: Unauthenticated PHP Object Injection in Law Office <= 3.20 versions","content_text":"ThemeREX · Law Office. Not in CISA KEV. EPSS 0.3% (higher than 23.2% of CVEs). CVSS 9.8 CRITICAL. Priority 13.9 of 100.","summary":"Unauthenticated PHP Object Injection in Law Office <= 3.20 versions","date_published":"2026-10-10T00:00:00.000Z","date_modified":"2026-10-13T13:28:15.000Z","tags":[],"_patchfirst":{"reason":"published","priority":13.9,"kev":null,"epss":{"score":0.00304,"percentile":0.23232},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ThemeREX","product":"Law Office","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2024-13448","url":"https://patchfirst.co/cve/CVE-2024-13448/","title":"CVE-2024-13448: ThemeREX Addons <= 2.32.3 - Unauthenticated Arbitrary File Upload in trx_addons_uploads_save_data","content_text":"ThemeREX · ThemeREX Addons. Not in CISA KEV. EPSS 0.9% (higher than 59.3% of CVEs). CVSS 9.8 CRITICAL. Priority 58.7 of 100.","summary":"ThemeREX Addons <= 2.32.3 - Unauthenticated Arbitrary File Upload in trx_addons_uploads_save_data","date_published":"2025-01-28T00:00:00.000Z","date_modified":"2026-04-08T17:02:37.000Z","tags":[],"_patchfirst":{"reason":"published","priority":58.7,"kev":null,"epss":{"score":0.00889,"percentile":0.59309},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ThemeREX","product":"ThemeREX Addons","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}}]}