ThemeREX Group vulnerabilities
We track 24 vulnerabilities in ThemeREX Group products across 24 products. 24 are rated high or critical, and none are known to be exploited. The most recent was published on October 23, 2026.
Latest ThemeREX Group vulnerabilities
- 9.8 Critical severity
Little Birdies: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects Little Birdies: from n/a through 1.3.16.
- 9.8 Critical severity
Vagabonds: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds: from n/a through 1.3.10.
- 8.1 High severity
Helion: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in ThemeREX Group Helion helion allows Object Injection.This issue affects Helion: from n/a through 1.1.12.
- 9.8 Critical severity
HotLock: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This issue affects HotLock: from n/a through 1.3.9.
- 9.8 Critical severity
Save Life: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life: from n/a through 1.2.14.
- 7.1 High severity
Kids Planet: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group Kids Planet allows Reflected XSS. This issue affects Kids Planet: from n/a through 2.2.14.2.
- 9.8 Critical severity
Camelia: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in ThemeREX Group Camelia camelia allows Object Injection.This issue affects Camelia: from n/a through 1.2.15.
- 9.8 Critical severity
Convex: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in ThemeREX Group Convex convex allows Object Injection.This issue affects Convex: from n/a through 1.16.0.
- 9.8 Critical severity
Dwell: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in ThemeREX Group Dwell dwell allows Object Injection.This issue affects Dwell: from n/a through 1.16.0.
- 9.8 Critical severity
Edema: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in ThemeREX Group Edema edema allows Object Injection.This issue affects Edema: from n/a through 1.2.2.2.
- 9.8 Critical severity
Greeny: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in ThemeREX Group Greeny greeny allows Object Injection.This issue affects Greeny: from n/a through 2.10.0.
- 9.8 Critical severity
Hogwords: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in ThemeREX Group Hogwords hogwords allows Object Injection.This issue affects Hogwords: from n/a through 1.2.7.
- 9.8 Critical severity
Hygia: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in ThemeREX Group Hygia hygia allows Object Injection.This issue affects Hygia: from n/a through 1.21.0.
- 9.8 Critical severity
IPharm: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in ThemeREX Group IPharm ipharm allows Object Injection.This issue affects IPharm: from n/a through 1.2.4.
- 9.8 Critical severity
Let's Play: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in ThemeREX Group Let's Play playhockey allows Object Injection.This issue affects Let's Play: from n/a through 1.1.15.
- 9.8 Critical severity
Partiso: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in ThemeREX Group Partiso partiso allows Object Injection.This issue affects Partiso: from n/a through 1.1.13.
- 9.8 Critical severity
Rosalinda: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in ThemeREX Group Rosalinda rosalinda allows Object Injection.This issue affects Rosalinda: from n/a through 1.2.4.
- 9.8 Critical severity
Smart Casa: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in ThemeREX Group Smart Casa smart-casa allows Object Injection.This issue affects Smart Casa: from n/a through 1.0.12.
- 9.8 Critical severity
Smash: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in ThemeREX Group Smash smash allows Object Injection.This issue affects Smash: from n/a through 1.12.0.
- 9.8 Critical severity
Tantra: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in ThemeREX Group Tantra tantra allows Object Injection.This issue affects Tantra: from n/a through 2.9.0.
- 9.8 Critical severity
Travesia: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in ThemeREX Group Travesia travesia allows Object Injection.This issue affects Travesia: from n/a through 1.1.16.
- 9.8 Critical severity
Gutentype: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in ThemeREX Group Gutentype gutentype allows Object Injection.This issue affects Gutentype: from n/a through 2.1.12.
- 9.8 Critical severity
Booklovers: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in ThemeREX Group Booklovers booklovers allows Object Injection.This issue affects Booklovers: from n/a through 2.13.0.
- 9.8 Critical severity
ThemeREX Addons: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Object Injection.This issue affects ThemeREX Addons: from n/a through 2.36.1.1.