ThemeREX vulnerabilities
We track 125 vulnerabilities in ThemeREX products across 60+ products. 125 are rated high or critical, and none are known to be exploited. The most recent was published on October 30, 2026.
Latest ThemeREX vulnerabilities
- 9.8 Critical severity
Organic Beauty: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in ThemeREX Organic Beauty organic-beauty allows Object Injection.This issue affects Organic Beauty: from n/a through <= 1.4.6.
- 9.8 Critical severity
Education Center | LMS & Online Courses…: Deserialization of Untrusted Data
The education theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.6.10 via deserialization of untrusted input in the 'themerex_callback_view_more_posts' function. This makes it possible for unauthenticated attacker
- 9.8 Critical severity
Puzzles | WP Magazine / Review with Store…: Deserialization of Untrusted Data
The Puzzles | WP Magazine / Review with Store WordPress Theme + RTL theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.2.4 via deserialization of untrusted input 'view_more_posts' AJAX action. This makes it possib
- 9.8 Critical severity
ThemeREX Addons: Unrestricted Upload of File with Dangerous Type
The ThemeREX Addons plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'trx_addons_uploads_save_data' function in all versions up to, and including, 2.32.3. This makes it possible for unauthenticated attacke
- 8.8 High severity
ThemeREX Addons: Improper Control of Filename for Include/Require Statement in PHP Program
The ThemeREX Addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.33.0 via the 'trx_sc_reviews' shortcode 'type' attribute. This makes it possible for authenticated attackers, with contributor-level and abov