Vendor

ThemeREX

46 ThemeREX CVEs in Patchfirst. None is in of vulnerabilities exploited in the wild yet.

CVEs: 46
In CISA KEV: 0
Known ransomware use: 0
Median days to KEV: –; from publication
Latest KEV listing: None

Watch ThemeREX Subscribe (RSS) JSON Feed All feeds

Products

In KEVOther CVEs

ProductKEVCVEs
Alliance In KEV: 0 CVEs: 1
Asia Garden In KEV: 0 CVEs: 1
Avventure In KEV: 0 CVEs: 1
Bonbon In KEV: 0 CVEs: 1
Buzz Stone | Magazine & Viral Blog WordPress Theme In KEV: 0 CVEs: 1
Coinpress In KEV: 0 CVEs: 1
Edge Decor In KEV: 0 CVEs: 1
Education Center In KEV: 0 CVEs: 1
EmojiNation In KEV: 0 CVEs: 1
Equadio In KEV: 0 CVEs: 1

Top ATT&CK techniques

What attackers do with ThemeREX CVEs

No techniques linked yet.

No techniques to export yet.

A layer for MITRE’s ATT&CK Navigator: techniques scored by the highest Patchfirst priority among their CVEs, neutral to red, with the CVE ids in each comment. “Open in Navigator” loads https://patchfirst.co/navigator/vendor/themerex.json. Or download it and in Navigator choose Open Existing Layer → Upload from local.

Counts are ThemeREX CVEs linked to the technique. Each link’s provenance is on the CVE page.

ThemeREX CVEs

46 CVEs, by priority

CVE-2024-13448ThemeREX Addons <= 2.32.3 - Unauthenticated Arbitrary File Upload in trx_addons_uploads_save_data
ThemeREX · ThemeREX AddonsCritical · 9.8
0.9%Top 41%
58.7priority
CVE-2026-54859Unauthenticated PHP Object Injection in Preservation <= 1.15 versions
ThemeREX · PreservationCritical · 9.8
0.5%Top 55%
16.5priority
CVE-2026-62002Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions
ThemeREX · Meals & WheelsCritical · 9.8
0.5%Top 56%
16.3priority
CVE-2026-61997Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions
ThemeREX · Legal StoneCritical · 9.8
0.5%Top 56%
16.3priority
CVE-2026-54860Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions
ThemeREX · OzistiCritical · 9.8
0.5%Top 58%
16.0priority
CVE-2026-54858Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions
ThemeREX · PrintyCritical · 9.8
0.5%Top 58%
16.0priority
CVE-2026-54857Unauthenticated PHP Object Injection in Quirky <= 1.23 versions
ThemeREX · QuirkyCritical · 9.8
0.5%Top 58%
16.0priority
CVE-2026-54856Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions
ThemeREX · RexCoinCritical · 9.8
0.5%Top 58%
16.0priority
CVE-2026-62001Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions
ThemeREX · MarcellCritical · 9.8
0.5%Top 59%
15.8priority
CVE-2026-61998Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions
ThemeREX · Le TruffeCritical · 9.8
0.5%Top 59%
15.8priority
CVE-2026-62090Unauthenticated PHP Object Injection in WineShop <= 3.20 versions
ThemeREX · WineShopCritical · 9.8
0.4%Top 69%
15.5priority
CVE-2026-62087Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions
ThemeREX · EquadioCritical · 9.8
0.4%Top 69%
15.5priority
CVE-2026-62086Unauthenticated PHP Object Injection in Juno <= 2.25 versions
ThemeREX · JunoCritical · 9.8
0.4%Top 69%
15.5priority
CVE-2026-62054Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions
ThemeREX · Yacht RentalCritical · 9.8
0.4%Top 69%
15.5priority
CVE-2026-62053Unauthenticated PHP Object Injection in Wine House <= 3.20 versions
ThemeREX · Wine HouseCritical · 9.8
0.4%Top 69%
15.5priority
CVE-2026-62052Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions
ThemeREX · TipsyCritical · 9.8
0.4%Top 69%
15.5priority
CVE-2026-62051Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions
ThemeREX · StargazeCritical · 9.8
0.4%Top 69%
15.5priority
CVE-2026-62050Unauthenticated PHP Object Injection in Splendour <= 1.23 versions
ThemeREX · SplendourCritical · 9.8
0.4%Top 69%
15.5priority
CVE-2026-62018Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions
ThemeREX · GunslingerCritical · 9.8
0.4%Top 61%
15.4priority
CVE-2026-62013Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions
ThemeREX · Edge DecorCritical · 9.8
0.4%Top 61%
15.4priority
CVE-2026-62014Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions
ThemeREX · EmojiNationCritical · 9.8
0.4%Top 63%
14.9priority
CVE-2026-62009Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions
ThemeREX · FilmaxCritical · 9.8
0.4%Top 63%
14.9priority
CVE-2026-62017Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions
ThemeREX · Good HomesCritical · 9.8
0.4%Top 64%
14.8priority
CVE-2026-62012Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions
ThemeREX · CoinpressCritical · 9.8
0.4%Top 64%
14.8priority
CVE-2026-62008Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions
ThemeREX · OrpheusCritical · 9.8
0.4%Top 64%
14.8priority
CVE-2026-62006Unauthenticated PHP Object Injection in Nuts <= 1.12 versions
ThemeREX · NutsCritical · 9.8
0.4%Top 64%
14.8priority
CVE-2026-78535Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions
ThemeRex · PhotoliaCritical · 9.8
0.3%Top 74%
14.4priority
CVE-2026-62016Unauthenticated PHP Object Injection in Gamic <= 1.19 versions
ThemeREX · GamicCritical · 9.8
0.4%Top 66%
14.3priority
CVE-2026-62015Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions
ThemeREX · GamezoneCritical · 9.8
0.4%Top 66%
14.3priority
CVE-2026-62011Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions
ThemeREX · BonbonCritical · 9.8
0.4%Top 66%
14.3priority
CVE-2026-62010Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions
ThemeREX · AvventureCritical · 9.8
0.4%Top 66%
14.3priority
CVE-2026-62005Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions
ThemeREX · MuziconCritical · 9.8
0.4%Top 66%
14.3priority
CVE-2026-62004Unauthenticated PHP Object Injection in Motorix <= 1.11 versions
ThemeREX · MotorixCritical · 9.8
0.4%Top 66%
14.3priority
CVE-2026-62003Unauthenticated PHP Object Injection in Mission <= 1.22 versions
ThemeREX · MissionCritical · 9.8
0.4%Top 66%
14.3priority
CVE-2026-81797Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions
ThemeRex · Buzz Stone | Magazine & Viral Blog WordPress ThemeCritical · 9.8
0.3%Top 76%
14.0priority
CVE-2026-78531Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions
ThemeREX · JacquelineCritical · 9.8
0.3%Top 77%
13.9priority
CVE-2026-78529Unauthenticated PHP Object Injection in Alliance <= 3.11 versions
ThemeREX · AllianceCritical · 9.8
0.3%Top 77%
13.9priority
CVE-2026-66564Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions
ThemeREX · ShiftCVCritical · 9.8
0.3%Top 77%
13.9priority
CVE-2026-66563Unauthenticated PHP Object Injection in Windsor <= 2.10 versions
ThemeREX · WindsorCritical · 9.8
0.3%Top 77%
13.9priority
CVE-2026-66483Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions
ThemeREX · Education CenterCritical · 9.8
0.3%Top 77%
13.9priority
CVE-2026-62125Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions
ThemeREX · Asia GardenCritical · 9.8
0.3%Top 77%
13.9priority
CVE-2026-62124Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions
ThemeREX · N7 | Golf Club Sports & EventsCritical · 9.8
0.3%Top 77%
13.9priority
CVE-2026-62123Unauthenticated PHP Object Injection in Invetex <= 2.18 versions
ThemeREX · InvetexCritical · 9.8
0.3%Top 77%
13.9priority
CVE-2026-62120Unauthenticated PHP Object Injection in Law Office <= 3.20 versions
ThemeREX · Law OfficeCritical · 9.8
0.3%Top 77%
13.9priority
CVE-2026-112847Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue affects…
ThemeREX · ZenSoulCritical · 9.8
0.3%Top 76%
13.5priority
CVE-2026-119526Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection
ThemeREX · Royal EventCritical · 9.8
No EPSS
6.9priority