ThemeREX has 24 CVEs on record. Disclosure cadence is accelerating: 24 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 21. The median CVSS is 9.8 (critical), with 20 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-502 (20) and CWE-79 (3). Most affected products: ThemeREX Addons (3), Alliance (1), Asia Garden (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 9.8
- Publish → KEV
- —
- Last 90 days
- 24 prev 0
Weakness classes
Products
- ThemeREX Addons 3
- Alliance 1
- Asia Garden 1
- Buzz Stone | Magazine & Viral Blog WordPress Theme 1
- Education Center 1
- Equadio 1
Worst active — by depth score
CVE-2026-81797Critical· 9.8Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions.54CVE-2026-78535Critical· 9.8Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.54CVE-2026-78531Critical· 9.8Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.54CVE-2026-78529Critical· 9.8Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.54CVE-2026-66564Critical· 9.8Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.54
ThemeREX vulnerabilities
CVEs affecting ThemeREX, newest first. Open any entry for full detail, references, and exploit status.
24 CVEsRSS
CVE-2026-81797Critical· 9.8Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions.
Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions.
CVE-2026-78535Critical· 9.8Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.
Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.
CVE-2026-78531Critical· 9.8Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.
Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.
CVE-2026-78529Critical· 9.8Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.
Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.
CVE-2026-66564Critical· 9.8Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.
Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.
CVE-2026-66563Critical· 9.8Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.
Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.
CVE-2026-66483Critical· 9.8Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions.
Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions.
CVE-2026-62125Critical· 9.8Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions.
Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions.
CVE-2026-62124Critical· 9.8Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions.
Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions.
CVE-2026-62123Critical· 9.8Unauthenticated PHP Object Injection in Invetex <= 2.18 versions.
Unauthenticated PHP Object Injection in Invetex <= 2.18 versions.
CVE-2026-62120Critical· 9.8Unauthenticated PHP Object Injection in Law Office <= 3.20 versions.
Unauthenticated PHP Object Injection in Law Office <= 3.20 versions.
CVE-2026-62090Critical· 9.8Unauthenticated PHP Object Injection in WineShop <= 3.20 versions.
Unauthenticated PHP Object Injection in WineShop <= 3.20 versions.
CVE-2026-62087Critical· 9.8Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions.
Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions.
CVE-2026-62086Critical· 9.8Unauthenticated PHP Object Injection in Juno <= 2.25 versions.
Unauthenticated PHP Object Injection in Juno <= 2.25 versions.
CVE-2026-62074High· 8.1Unauthenticated Local File Inclusion in Ozeum <= 1.3.0 versions.
Unauthenticated Local File Inclusion in Ozeum <= 1.3.0 versions.
CVE-2026-62054Critical· 9.8Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions.
Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions.
CVE-2026-62053Critical· 9.8Unauthenticated PHP Object Injection in Wine House <= 3.20 versions.
Unauthenticated PHP Object Injection in Wine House <= 3.20 versions.
CVE-2026-62052Critical· 9.8Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions.
Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions.
CVE-2026-62051Critical· 9.8Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions.
Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions.
CVE-2026-62050Critical· 9.8Unauthenticated PHP Object Injection in Splendour <= 1.23 versions.
Unauthenticated PHP Object Injection in Splendour <= 1.23 versions.
CVE-2026-94063High· 7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Education Center education allows Reflected XSS.This issue affects Education Center: from n/a through 3.6.12.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Education Center education allows Reflected XSS.This issue affects Education Center: from n/a through 3.6.12.
CVE-2026-97235High· 7.1Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.
Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.
CVE-2026-97236Medium· 6.5Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.
Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.
CVE-2026-62105Critical· 9.8Unauthenticated PHP Object Injection in ThemeREX Addons < 2.45.0 versions.
Unauthenticated PHP Object Injection in ThemeREX Addons < 2.45.0 versions.