Themerex
Monthly
PHP object injection in the ThemeREX Royal Event WordPress theme affects versions up to and including 2.0: attacker-supplied serialized data reaching an unserialize() call can instantiate arbitrary objects. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, 9.8) describes a network-reachable, low-complexity, unauthenticated flaw with full confidentiality, integrity and availability impact, and the vuln.today decision label is act_now. No public exploit code or CISA KEV entry is reported in the available data, and the actual impact hinges on whether a usable POP gadget chain exists in the theme, WordPress core or an installed plugin; the specific triggering endpoint and parameter are not described in the available sources.
Gunslinger WordPress theme through version 1.11 exposes an unauthenticated PHP object injection issue that can let remote attackers supply serialized input to a PHP object deserialization path, carrying high confidentiality, integrity, and availability impact if a usable gadget chain is present. The CVSS vector confirms network reachability with no privileges or user interaction, but the exact vulnerable parameter or endpoint is not described in the available sources. No public exploit is identified at time of analysis, no fixed version is stated, and the vuln.today decision label is act_now.
Unauthenticated PHP object injection in the ThemeRex Good Homes WordPress theme through version 1.3.13 can allow remote attackers to supply serialized data that may cause high confidentiality, integrity, and availability impact if a usable POP gadget chain exists in the theme, an installed plugin, or WordPress core. The CVSS 3.1 score is 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and vuln.today assigns an act_now priority. The provided data does not identify public exploit code or confirm CISA KEV active exploitation, and it does not confirm that a usable gadget chain or the specific vulnerable input is present.
Unauthenticated PHP object injection in the ThemeREX Gamic WordPress theme through version 1.19 lets remote attackers supply crafted serialized input to a deserialization sink, and the CVSS 9.8 vector indicates high confidentiality, integrity, and availability impact. The vulnerability class is CWE-502; full code-execution impact depends on a usable PHP gadget chain, and the specific vulnerable parameter or endpoint is not described in the available sources. The provided intelligence has no CISA KEV listing or public exploit identified at time of analysis, while the vuln.today decision label is act_now.
Unauthenticated PHP object injection in the ThemeREX Gamezone WordPress theme through version 1.1.11 can let remote attackers influence deserialization on sites where the vulnerable theme is active, with the supplied CVSS vector indicating high confidentiality, integrity, and availability impact. Exploitation requires Gamezone to be installed and active, and the available sources do not describe the trigger or confirm a usable POP gadget chain, so realized impact may be narrower than the 9.8 base score. No public exploit identified at time of analysis, but the intelligence decision label is act_now.
Unauthenticated PHP object injection in the ThemeRex EmojiNation WordPress theme through version 1.0.12 allows remote attackers to pass crafted serialized input into a reachable theme endpoint, scored 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and rated act_now by vuln.today priority. Success depends on whether an exploitable PHP gadget chain is loaded via the theme, an active plugin, or WordPress core; without a usable chain the practical result may be limited to a crash or be non-exploitable, and the vulnerable parameter and trigger are not described in the available sources. No public exploit code and no CISA KEV entry are associated with this CVE at time of analysis, and the reporting rests on a single source (Patchstack).
Unauthenticated PHP object injection in the ThemeRex Edge Decor WordPress theme through version 2.9 can let remote attackers feed crafted serialized data into PHP object deserialization on affected sites. The issue carries CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and an act_now priority label, but impact beyond object injection depends on a usable POP gadget chain in the theme, plugins, or WordPress core. Only sites with this specific theme installed and active are exposed, and the provided intelligence contains no KEV status or public exploit reference; no public exploit was identified at time of analysis.
Unauthenticated PHP object injection in the Coinpress WordPress theme through version 1.0.15 allows remote attackers to pass crafted serialized data to the theme, with the supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) indicating full confidentiality, integrity, and availability impact and no authentication or user interaction requirement. The vuln.today Decision label is act_now and the finding is reported by Patchstack, but the available sources do not name the vulnerable parameter or endpoint and do not confirm a reachable POP gadget chain, so file-write or code-execution impact is conditional on such a chain existing in the theme, co-installed plugins, or WordPress core. No public exploit is identified in the supplied data.
PHP object injection in the ThemeRex Bonbon WordPress theme through version 1.11 is reachable without authentication or user interaction, and the supplied CVSS 3.1 vector rates it 9.8 with high confidentiality, integrity, and availability impact. The practical impact depends on a usable gadget chain in the theme, WordPress core, or a co-installed plugin; the deserialization entry point and whether a working gadget chain is publicly available are not described in the available sources. No public exploit was identified in the supplied data at time of analysis, no fixed version is stated, and the vuln.today decision label is act_now.
Unauthenticated PHP object injection in the Avventure WordPress theme through version 1.1.12 gives remote attackers a route to supply serialized data to an unserialize() sink, with CVSS 3.1 scored 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and a vuln.today priority decision of act_now. The available sources do not identify the specific theme endpoint or parameter that reaches the sink, and they do not confirm that a usable gadget chain is present for full code execution. No public exploit was identified in the provided data at time of analysis.
Unauthenticated PHP Object Injection in the Filmax WordPress theme through version 1.1.11 lets remote attackers reach deserialization logic without credentials or user interaction, carrying a 9.8 Critical CVSS score and an act_now priority from vuln.today. Impact is full confidentiality, integrity and availability loss per the assessed vector, although real-world damage depends on a usable POP gadget chain being reachable through the theme, an active plugin, or WordPress core; the available sources do not describe the injection vector or confirm such a chain, so the trigger is not described in the available sources. No public exploit code or active exploitation is confirmed at time of analysis, and the only supplied reference is Patchstack's vulnerability entry for the theme.
Unauthenticated PHP object injection in the ThemeRex Orpheus WordPress theme, affecting versions 1.8 and earlier, lets remote attackers reach unsafe deserialization of attacker-supplied data, carrying an assessed CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) against confidentiality, integrity and availability. The exact injection point, endpoint or feature that reaches the unsafe unserialize call is not described in the available sources, and real-world impact depends on a usable PHP gadget (POP) chain existing in the theme, WordPress core, or co-installed plugins, which the sources do not confirm. No public exploit code or CISA KEV entry was identified at time of analysis, but the issue is prioritized act_now in vuln.today's decision signals and was reported through Patchstack.
Unauthenticated PHP object injection in the ThemeREX 'Nuts' WordPress theme (versions up to and including 1.12) lets remote attackers pass crafted serialized data into a PHP unserialize() path without any credentials, rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) by the reporter. Actual exploitation success is conditional: the practical impact depends on a usable POP/gadget chain being present in the theme or in co-installed plugins or WordPress core, and the available sources do not confirm such a chain or identify the exact request/feature that reaches the deserialization sink. No public exploit code is confirmed and the CVE is not in CISA KEV, although the vuln.today decision label is act_now, so this should be treated as a high-priority patch item for sites running the theme rather than as an actively exploited emergency.
Unauthenticated PHP object injection in the ThemeRex Muzicon WordPress theme through version 1.15 allows remote attackers to pass attacker-controlled serialized data into an unserialize() sink without any credentials, which can corrupt application state or escalate to code execution if a usable gadget chain is reachable. The vulnerability carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is tracked under CWE-502; no public exploit code has been reported, it is not listed in CISA KEV, and no EPSS figure was supplied. The practical limiting factor is the need for a POP chain in the theme, WordPress core, or a co-installed plugin, and the precise vulnerable endpoint and parameter are not described in the available sources.
PHP object injection in the commercial WordPress theme Motorix (ThemeRex) at version 1.11 and earlier lets unauthenticated remote attackers pass serialized input that reaches a PHP unserialize() call, potentially instantiating arbitrary objects and - if a usable POP gadget chain is present in the theme, its bundled plugins or WordPress core - escalating to code execution or full site compromise. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) rates confidentiality, integrity and availability impact as high, and the vuln.today decision label is act_now, so it should be handled as a near-term patching priority rather than a high-score-but-low-risk item. No CISA KEV entry and no public exploit code were identified in the available sources at time of analysis, and the input parameter and gadget chain involved are not described.
Unauthenticated PHP object injection in the ThemeREX Mission theme for WordPress, versions up to and including 1.22, lets remote attackers feed attacker-controlled serialized data into a PHP deserialization sink, carrying a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with maximal confidentiality, integrity and availability impact. Only sites running this specific theme at 1.22 or earlier are exposed, which limits the attackable population, but no login or user interaction is required to reach the flaw. The issue was reported through Patchstack and is rated act_now by vulnerability intelligence; the supplied data contains no CISA KEV entry and no confirmed working exploit code, so no public exploit is identified at time of analysis, and the supplier did not identify the specific injectable parameter or a usable gadget chain, meaning realized impact may vary site by site.
PHP object injection in ThemeRex's Meals & Wheels theme through version 1.1.13 is remotely reachable without authentication or user interaction and is rated 9.8 CVSS. The entry point and trigger are not described in the available sources, and real-world impact depends on a reachable POP gadget chain that the evidence does not confirm; no public exploit was identified at time of analysis. Patchstack reported the flaw, and no fixed version is listed in the provided evidence.
Unauthenticated PHP object injection in the ThemeRex Marcell WordPress theme through version 1.2.14 allows remote attackers to supply attacker-controlled serialized data to a PHP deserialization path, with a CVSS 3.1 score of 9.8 and CWE-502. The CVSS vector indicates remote, low-complexity, unauthenticated exploitation with no user interaction, and the vuln.today priority decision is act_now. No public exploit was identified at time of analysis, and the practical impact depends on whether a reachable POP gadget chain exists in the theme or installed plugins; the trigger endpoint or parameter is not described in the available sources.
Signals conflict in a way worth stating plainly: the Le Truffe WordPress theme through version 1.1.7 contains an unauthenticated PHP object injection (CWE-502) scored CVSS 9.8, but whether it yields code execution or other high-impact actions depends on a suitable POP gadget chain in the loaded WordPress core, plugins, or theme code. Patchstack is the reporting source and the vuln.today decision label is act_now; no public exploit identified at time of analysis, and the vulnerable parameter and endpoint are not described in the supplied data.
PHP object injection in the ThemeRex Legal Stone WordPress theme through version 1.2.11 allows unauthenticated remote attackers to pass crafted serialized data into the theme's PHP deserialization path, which the vendor-issued CVSS 3.1 vector rates 9.8 (AV:N/AC:L/PR:N/UI:N, C/I/A High) and which the priority assessment labels act_now. Because this is a theme rather than a self-contained application, meaningful post-injection impact depends on a usable POP gadget chain being reachable in the theme or in co-installed plugins, and the supplied sources do not identify the injectable endpoint or any specific gadget chain. No CISA KEV entry, no confirmed active exploitation and no public exploit code were identified in the provided intelligence at time of analysis, so the high score reflects worst-case potential on unpatched sites rather than observed attacks.
Ozisti WordPress theme 1.1.10 and earlier carries an unauthenticated PHP object injection issue rated CVSS 9.8, and the vuln.today decision label is act_now; the finding is reported by Patchstack. The CVSS vector indicates network reachability with no privileges or user interaction, but the available sources do not describe the specific injection point or confirm that an exploitable PHP gadget chain is present. No public exploit was identified at time of analysis, and no KEV active-exploitation signal is present in the provided data.
Unauthenticated PHP object injection in the ThemeREX Preservation WordPress theme through version 1.15 can let remote attackers supply serialized input that the theme deserializes, with a CVSS 9.8 rating reflecting potential high confidentiality, integrity, and availability impact. Exploitation requires a WordPress site running the affected theme, and while the vector shows no authentication or user interaction, the available sources do not confirm a usable gadget chain or identify the vulnerable endpoint and parameter. No public exploit was identified at time of analysis, but the act_now priority and severe rating warrant prompt verification against the Patchstack advisory.
Unauthenticated PHP object injection in the Printy WordPress theme through version 1.13.0 lets remote attackers supply serialized data to a PHP deserialization point without credentials or user interaction, carrying a CVSS 9.8 rating and an act_now priority. The supplied intelligence does not identify active exploitation (no CISA KEV entry) or public exploit code, and real-world impact depends on whether a usable POP gadget chain exists in Printy or a co-installed plugin because the vulnerable parameter and trigger are not described. Sites running Printy 1.13.0 or earlier should be treated as exposed until a fixed release is confirmed.
Unauthenticated PHP object injection affects the ThemeRex Quirky WordPress theme through version 1.23, with a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). A remote attacker can reach the flaw without authentication, but the vulnerable parameter and endpoint are not identified in the available sources, and meaningful compromise depends on a usable POP gadget chain in the theme, WordPress core, or an installed plugin. No public exploit or confirmed active exploitation was identified at time of analysis, and the provided priority label is act_now.
Unauthenticated PHP object injection in the ThemeRex RexCoin WordPress theme at version 1.2.6 and earlier allows remote attackers to reach the theme's deserialization path without credentials and without user interaction, carrying a CVSS 3.1 score of 9.8 with high confidentiality, integrity and availability impact. Realized impact hinges on whether a usable gadget/POP chain is reachable in the theme or a co-installed plugin, a condition the available sources do not confirm, and the specific request, parameter or sink that triggers the injection is likewise not described. No public exploit code was identified at time of analysis, no fixed version is listed in the available data, and the vuln.today priority is act_now based largely on a single Patchstack source.
PHP object injection through deserialization of untrusted data affects the ThemeREX ZenSoul WordPress theme at all versions through 1.13, exposed over the network with a CVSS score of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) per the supplied vector. The available sources do not identify the specific endpoint, parameter, or theme feature that reaches the unsafe deserialization, nor whether a usable POP gadget chain exists in the theme, WordPress core, or installed plugins - a factor that typically governs whether object injection escalates to code execution, file operations, or data disclosure. No confirmation of active exploitation (CISA KEV) or verified working exploit code was provided; a public reference exists at the Patchstack vulnerability database entry, and the site's priority label is act_now.
Unauthenticated PHP Object Injection in the Buzz Stone | Magazine & Viral Blog WordPress theme (vendor themerex) at versions 1.0.2 and earlier lets any remote attacker who can reach an affected request path supply serialized PHP data that the theme passes into an unsafe unserialize() call, yielding a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact). Because the attack is unauthenticated and requires no user interaction, exploitation depends only on the site running this specific niche theme and on a usable POP gadget chain being reachable in the theme, WordPress core, or a co-installed plugin; absent such a gadget, impact is limited to object-injection side effects rather than full remote code execution. No public exploit code has been identified at time of analysis, and the primary limiting factor is narrow deployment - only sites running this particular theme are exposed.
PHP object injection in the Photolia WordPress theme (versions <= 1.0.3) allows unauthenticated remote attackers to trigger deserialization of untrusted data, potentially leading to code execution, file manipulation, or data theft if a usable POP gadget chain exists in the WordPress environment. Although rated CVSS 9.8, the practical risk is tempered by the requirement for a reachable gadget chain in core or co-installed components, and no public exploit has been identified at time of analysis. Site owners should treat this as high severity but prioritize based on exposure.
Unauthenticated PHP object injection in the ThemeREX Jacqueline WordPress theme (versions 2.22 and earlier) can let remote attackers achieve full confidentiality, integrity, and availability impact (CVSS 9.8) if a usable POP gadget chain is reachable in the theme or other installed WordPress components. Exploitation requires no authentication or user interaction against a site with the theme active, but the practical impact depends on the presence of a viable gadget chain. No public exploit has been identified at time of analysis, and no vendor-released patch was found in the provided data.
Unauthenticated PHP Object Injection in the ThemeREX Alliance WordPress theme (versions 3.11 and earlier) allows remote attackers to pass crafted serialized data into a PHP unserialize() call, which can lead to arbitrary object instantiation and, where a usable POP gadget chain exists, full compromise of the underlying site with high impact to confidentiality, integrity and availability. The vulnerability carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), so no authentication or user interaction is required and default installations are reachable over the network; at time of analysis no public exploit code has been identified and the issue is not listed in CISA KEV, though the EPSS-style risk profile of an unauthenticated WordPress theme flaw of this class typically rises quickly once details circulate. Practical impact depends on the presence of a reachable gadget chain in the theme, WordPress core, or other installed plugins; sites without such a chain may see reduced, but still material, exposure because the injection primitive itself is remotely reachable.
Unauthenticated PHP object injection in the ThemeREX ShiftCV WordPress theme, affecting versions up to and including 3.0.14, lets remote attackers feed crafted serialized input into an unsafe deserialization sink, which can escalate to remote code execution when a usable POP gadget chain is reachable in the theme, WordPress core, or an installed plugin. The flaw carries a 9.8 Critical rating (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication and no user interaction are required and successful exploitation can fully compromise confidentiality, integrity and availability. There is no public exploit identified at time of analysis and no CISA KEV confirmation, so the practical limiting factor is the availability of a reachable gadget chain rather than the injection primitive itself; no EPSS score was supplied in the available intelligence.
Unauthenticated PHP object injection in the WordPress theme Windsor (ThemeREX) through version 2.10 lets remote attackers feed crafted serialized data into an unserialize() call reachable without authentication or user interaction, scoring a maximum base 9.8 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Reported by Patchstack and tracked as CWE-502, the flaw's realized impact depends on whether a usable PHP gadget chain exists across the theme, WordPress core, and installed plugins - in an unpatched site with a suitable gadget, this can escalate to code execution, arbitrary file or data manipulation, whereas without one the injection may be largely inert. At time of analysis there is no public exploit code identified and no CISA KEV listing, so exploitation is not confirmed in the wild; no vendor-released fix version appears in the available advisory data. Given the unauthenticated, network-reachable profile and the prevalence of gadget-rich plugin stacks, this should be treated as high priority for any site running the theme.
Unauthenticated PHP object injection in the ThemeRex Education Center WordPress theme (versions up to and including 3.6.12) lets remote attackers feed serialized data into an unserialize() sink with no authentication and no user interaction, scored CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Actual damage depends on whether a usable POP gadget chain exists in the theme, WordPress core, or co-installed plugins, because that determines whether object injection escalates to code execution or full confidentiality, integrity, and availability loss. No public exploit code and no CISA KEV listing were identified at time of analysis, and real-world exposure is constrained by the narrow installed base of this specific commercial theme.
Unauthenticated PHP object injection in the ThemeRex 'Asia Garden' WordPress theme (versions 1.3.1 and earlier) allows remote attackers to pass crafted serialized data into PHP's unserialize() and instantiate arbitrary objects on the target site. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8 Critical), exploitation requires no authentication or user interaction against an affected installation and could yield full confidentiality, integrity, and availability impact - typically arbitrary code execution, file manipulation, or SQL injection when a usable POP gadget chain exists in the theme, WordPress core, or an active plugin. No public exploit code has been identified at time of analysis, and the flaw is not confirmed as actively exploited (CISA KEV); no EPSS score was supplied. Practical exploitability hinges on the presence of a viable gadget chain, without which impact may drop to denial of service or be difficult to weaponize, and the exact vulnerable parameter/endpoint is not detailed in the available data.
Unauthenticated PHP object injection in the WordPress theme N7 | Golf Club Sports & Events (versions 2.21 and earlier, vendor ThemeREX) lets a remote attacker supply a crafted serialized PHP object to a theme endpoint without any authentication or user interaction, yielding a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H). Because no public exploit code and no CISA KEV entry were identified at time of analysis, real-world impact hinges on whether a usable POP gadget chain exists in the theme, WordPress core, or a co-installed plugin; where such a chain is reachable, the deserialization flaw can escalate to full remote code execution. Exposure is limited to sites that have this specific niche golf/sports theme installed and active, but for those sites the worst-case profile is complete compromise by an unauthenticated attacker.
Unauthenticated PHP object injection in the ThemeRex Invetex WordPress theme affects versions 2.18 and earlier, allowing remote attackers to supply crafted serialized input to a theme endpoint that performs unsafe deserialization. Successful exploitation can lead to full compromise of the confidentiality, integrity, and availability of the affected site, but the practical ceiling depends on whether a usable PHP POP gadget chain exists in the theme, an active plugin, or WordPress core. No public exploit code or confirmed active exploitation was identified at time of analysis, and the CVSS score should be weighed against the assessed AC:H rather than the reported AC:L.
Unauthenticated PHP object injection in the ThemeRex 'Law Office' WordPress theme at version 3.20 and earlier lets remote attackers with no credentials and no user interaction pass attacker-controlled serialized data into an unsafe unserialize() path, which the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) scores as complete loss of confidentiality, integrity and availability. Practical impact depends heavily on whether a usable POP gadget chain exists in the theme, an installed plugin, or WordPress core; without a reachable gadget the result may be far below the theoretical 9.8 headline score. No CISA KEV entry, EPSS score, or public exploit code is present in the available intelligence, so this is assessed as no public exploit identified at time of analysis, and exposure is limited to sites running this commercial legal-industry theme.
Unauthenticated PHP object injection in the ThemeRex WineShop WordPress theme (all versions up to and including 3.20) lets remote attackers push attacker-controlled serialized data into a PHP unserialize() operation, enabling instantiation of arbitrary PHP objects and - where a usable gadget chain exists in the theme, co-installed plugins, or the runtime - remote code execution, arbitrary file read/write, or SQL injection. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N), meaning exploitation against a default installation requires no authentication and no user interaction, per the published PR:N/UI:N vector. At time of analysis there is no public exploit code identified and the theme is not listed in CISA KEV; practical exposure is limited to sites actually running this niche wine-shop theme and by whether an exploitable POP gadget chain is reachable.
Unauthenticated PHP object injection in the ThemeRex Equadio WordPress theme (versions up to and including 1.1.4) allows remote attackers to supply crafted serialized input to vulnerable deserialization entry points, potentially leading to remote code execution, file deletion, or other high-impact outcomes depending on available gadget chains. The flaw carries a CVSS 3.1 base score of 9.8, reflecting network exploitability with low complexity, no authentication, and no user interaction required. No public exploit code or active exploitation has been identified at time of analysis, though the severity and ease of exploitation make prompt patching critical.
Unauthenticated PHP Object Injection in the ThemeRex 'Juno' WordPress theme affects all versions up to and including 2.25, allowing remote attackers to supply a crafted serialized PHP object that the theme deserializes without validation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) rates this as a network-reachable, low-complexity flaw requiring no credentials and no user interaction, with high confidentiality, integrity and availability impact; however, real-world impact depends on whether a usable POP gadget chain exists in the theme or in co-installed plugins, which is not confirmed in the available data. No public exploit code and no confirmed active exploitation were identified at time of analysis (Patchstack is credited as the reporting source), and exploitation is limited to the subset of WordPress sites running this specific commercial theme at an affected version.
Unauthenticated local file inclusion in the Ozeum WordPress theme (ThemeREX) through version 1.3.0 allows remote attackers to control a PHP include/require path and read arbitrary files on the hosting server, potentially exposing wp-config.php database credentials, API keys, and other sensitive content. Patchstack reports this as a High-severity issue at CVSS 8.1, while the independent assessment keeps attack complexity High (AC:H) and lowers integrity and availability impact to Low (C:H/I:L/A:L), meaning reliable exploitation hinges on conditions the attacker does not fully control and the realistic exposure is confined to sites running this specific theme at or below 1.3.0. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Unauthenticated PHP object injection in the ThemeRex 'Yacht Rental' WordPress theme affects all versions up to and including 2.6, allowing a remote attacker to pass crafted serialized data into a PHP deserialization path without credentials or user interaction. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N), the theoretical worst case is high confidentiality, integrity, and availability impact with a 9.8 base score. No public exploit code has been identified at time of analysis, and the practical severity depends on whether a usable PHP gadget chain exists within the theme, WordPress core, or co-installed plugins - without such a gadget, real-world impact may be reduced.
Unauthenticated PHP Object Injection in the Wine House WordPress theme (version 3.20 and earlier, distributed by ThemeREX) allows a remote attacker to deliver a crafted serialized payload to an unserialize() call, which the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates at 9.8 Critical with full Confidentiality, Integrity, and Availability impact. Because PR:N and UI:N are confirmed by the vector, no authentication or victim interaction is required - any unauthenticated request to the affected endpoint against a site with the theme installed and active can carry the payload. No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical severity is bounded by whether a usable POP gadget chain exists in the theme, WordPress core, or co-installed plugins; absent such a gadget, impact may degrade to denial of service or be non-exploitable, and the target population is limited to sites running this single commercial theme.
Unauthenticated PHP object injection in the ThemeREX Tipsy WordPress theme through version 1.6 allows remote attackers to supply crafted serialized data that the theme passes to PHP unserialize(), potentially leading to remote code execution, file manipulation, or SQL injection where a usable POP gadget chain exists. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N), the flaw is network-reachable, low-complexity, and requires neither authentication nor user interaction, with full confidentiality, integrity, and availability impact (9.8). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; exploitation is constrained by the need for an exploitable gadget chain in the theme, WordPress core, or an active plugin.
Unauthenticated PHP object injection in the Stargaze WordPress theme (versions 1.10 and earlier) allows remote attackers to submit a crafted serialized payload that the theme feeds to PHP's unserialize(), which can trigger arbitrary object instantiation and, where a usable gadget chain is present, code execution or full site compromise; the maximum-base CVSS 3.1 score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects high confidentiality, integrity, and availability impact. Per that vector no authentication (PR:N) and no user interaction (UI:N) are required, and the CPE record cpe:2.3:a:themerex:stargaze ties the exposure to the ThemeREX Stargaze theme, so only sites with this theme installed and active are in scope. At time of analysis there is no public exploit identified, and the practical ceiling on impact depends on whether a viable POP gadget chain exists in the theme itself, a co-installed plugin, or WordPress core.
Unauthenticated PHP object injection in the ThemeRex Splendour WordPress theme (versions 1.23 and earlier) lets remote attackers pass crafted serialized data into an unsafe deserialization routine, which can lead to remote code execution, arbitrary file manipulation, or full site takeover if a usable gadget chain is reachable. The flaw carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is classified as CWE-502 Deserialization of Untrusted Data; the vector confirms the entry point is reachable over the network with no authentication and no user interaction. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited, so real-world impact hinges on the presence of a POP gadget chain in the theme, co-installed plugins, or WordPress core, and on the narrow deployment footprint of this specific commercial theme.
Reflected cross-site scripting (XSS) in the ThemeREX Education Center WordPress theme (versions up to and including 3.6.12) allows remote attackers to execute arbitrary JavaScript in a victim's browser when they click a crafted link. The flaw requires user interaction (UI:R) and no authentication (PR:N), and it is reported by Patchstack with a CVSS 3.1 base score of 7.1; however, our assessment indicates no availability impact (A:N), limiting the impact to confidentiality and integrity of the victim's session. No public exploit code or active exploitation has been identified at time of analysis.
Reflected cross-site scripting in the ThemeREX Addons WordPress plugin affects all versions below 2.45.0, allowing an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser within the affected site's origin. Exploitation requires user interaction (CVSS vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base score 7.1): the attacker must lure a victim to a crafted link or attacker-influenced page that triggers the injected payload, and success also depends on the site lacking a WAF or the patched plugin. There is no public exploit code identified at time of analysis and no confirmed active exploitation; impact is confined to the victim's browser session (low confidentiality, integrity and availability) rather than direct server compromise.
Unauthenticated PHP Object Injection in the ThemeREX Addons (trx_addons) WordPress plugin before 2.45.0 lets remote attackers inject arbitrary serialized PHP objects into the application. Because no authentication is required (CVSS 9.8, PR:N/UI:N), an attacker can supply crafted serialized data to a vulnerable entry point; when combined with a suitable POP gadget chain present in the plugin, another plugin, a theme, or WordPress core, this can escalate to code execution, arbitrary file operations, or data compromise. Reported by Patchstack; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Insecure deserialization in the Abelle WordPress theme (ThemeREX) versions 1.22 and earlier lets unauthenticated remote attackers inject crafted PHP objects that the application deserializes, enabling PHP Object Injection. Because attacker-supplied serialized data reaches unsafe unserialize() logic without authentication, an adversary can potentially achieve remote code execution, data tampering, or full site compromise depending on available gadget chains in WordPress core, the theme, or co-installed plugins. There is no public exploit identified at time of analysis, but the flaw carries a CVSS 9.8 rating reflecting network-reachable, unauthenticated, high-impact exploitation.
Broken access control in the Booked WordPress appointment-scheduling plugin (versions <= 3.0.0, by ThemeRex) lets low-privileged authenticated users (Subscriber role) reach functionality or data they should not, resulting in high confidentiality exposure and limited integrity impact per the CVSS vector. The flaw stems from missing authorization checks (CWE-862) on plugin actions, so any registered site user can abuse it. No public exploit is identified at time of analysis and it is not listed in CISA KEV; the issue was reported through Patchstack.
Unauthenticated Local File Inclusion in ThemeREX EcoBlue WordPress theme versions 1.15 and earlier enables remote attackers to include arbitrary local files on the server without credentials, potentially leading to source code disclosure and remote code execution via PHP file inclusion (CWE-98). No public exploit identified at time of analysis, but the unauthenticated network-reachable nature combined with WordPress's broad deployment surface makes this notable. EPSS data was not provided, and the issue is not listed in CISA KEV.
Unauthenticated Local File Inclusion in the ThemeREX AutoParts WordPress theme versions 1.5.8 and earlier allows remote attackers to include and execute arbitrary local files on the server. No public exploit identified at time of analysis, but the CWE-98 classification and PR:N CVSS vector make this a meaningful pre-authentication risk for any WordPress site running the theme. Successful exploitation typically leads to sensitive file disclosure (wp-config.php) and, when combined with log poisoning or uploaded content, full remote code execution.
A PHP Object Injection vulnerability exists in the ThemeREX Buisson WordPress theme through version 1.1.11, stemming from unsafe deserialization of untrusted data (CWE-502). This flaw allows attackers to inject malicious serialized objects that can lead to arbitrary code execution or other object manipulation attacks depending on available gadget chains in the WordPress environment. While no CVSS score or EPSS data is currently published and the vulnerability has not been listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, the public disclosure via Patchstack indicates active awareness in the security community.
A PHP Object Injection vulnerability exists in the ThemeREX Work & Travel Company WordPress theme through version 1.2, stemming from unsafe deserialization of untrusted data (CWE-502). An attacker can exploit this vulnerability to inject malicious objects into the application, potentially leading to remote code execution or arbitrary object manipulation depending on the gadget chains available in the WordPress environment. No CVSS score, EPSS data, or KEV status is currently available, and the vulnerability was identified and reported by Patchstack, though active exploitation status remains unclear.
A PHP Object Injection vulnerability exists in ThemeREX Love Story WordPress theme through version 1.3.12, stemming from unsafe deserialization of untrusted data. This vulnerability allows attackers to inject malicious serialized objects that can lead to remote code execution or other object-oriented attack chains. The vulnerability is classified as CWE-502 (Deserialization of Untrusted Data) and has been reported by Patchstack; no CVSS score or EPSS data is currently available, and KEV status is unknown.
A security vulnerability in ThemeREX ProLingua prolingua allows PHP Local File Inclusion (CVSS 8.1). High severity vulnerability requiring prompt remediation.
A Local File Inclusion (LFI) vulnerability exists in the ThemeREX Nelson WordPress theme through version 1.2.0, allowing attackers to read arbitrary files from the affected server. The vulnerability stems from improper control of filenames in PHP include/require statements (CWE-98), enabling information disclosure attacks without authentication. While no CVSS score or EPSS data is currently available, the LFI classification and public disclosure via Patchstack indicate this is a genuine security concern affecting WordPress installations using vulnerable Nelson theme versions.
A Local File Inclusion (LFI) vulnerability exists in the ThemeREX Good Homes WordPress theme through version 1.3.13, allowing attackers to include and execute arbitrary local files on the affected server. The vulnerability stems from improper control of filenames in PHP include/require statements (CWE-98), enabling unauthenticated attackers to disclose sensitive information or achieve remote code execution by accessing system files. No CVSS score, EPSS data, or active KEV designation was reported, but the LFI classification and information disclosure impact indicate this requires prompt patching.
A PHP Local File Inclusion vulnerability exists in the ThemeREX Melania WordPress theme, allowing remote attackers to include and execute arbitrary local files on the server. All versions up to and including 2.5.0 are affected. The CVSS score of 8.1 indicates high severity with network-based attack vector, though attack complexity is rated as high; there is no evidence of active exploitation (not in KEV) or public proof-of-concept at this time.
Cross-site scripting in ThemeREX Addons (the trx_addons WordPress plugin) below version 2.45.0 lets an authenticated attacker with only a Subscriber-level account inject script content that executes in the browser of any higher-privileged user who views it, enabling session theft or actions performed in the victim's context. Reaching the vulnerable input requires a Subscriber account - trivially obtainable when open WordPress registration is enabled - and successful exploitation is further gated by victim interaction, so an unauthenticated remote attacker cannot exploit a hardened site with registration disabled. No public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated CSRF in Booked WordPress plugin (versions <= 3.0.0) enables remote attackers to trigger availability-impacting actions against authenticated WordPress users without their consent. The CVSS vector (C:N/I:N/A:H) indicates this CSRF leads to a destructive availability outcome - likely deletion or corruption of booking/scheduling data - rather than data theft or code execution. No public exploit or active exploitation has been identified at time of analysis, though the low attack complexity and no required privileges for staging the attack make social-engineering delivery straightforward.
Unauthenticated local file inclusion in the Line Agency WordPress theme versions 1.3.1 and earlier allows remote attackers to include and disclose arbitrary local files on the underlying server, potentially leading to sensitive data exposure and, depending on PHP configuration, remote code execution. The flaw is reported by Patchstack and is mapped to CWE-98 (PHP Remote File Inclusion), with no public exploit identified at time of analysis and no listing in the CISA KEV catalog.
Unauthenticated local file inclusion in the ThemeREX Etude WordPress theme versions 1.6 and earlier allows remote attackers to coerce the application into including arbitrary PHP files, potentially leading to source disclosure, sensitive data exposure, and possible remote code execution depending on writable locations on the host. The high CVSS score of 8.1 reflects significant confidentiality, integrity, and availability impact, though the high attack complexity (AC:H) suggests non-trivial preconditions; no public exploit identified at time of analysis.
Local File Inclusion in the ThemeRex Eventicity WordPress theme versions 1.5 and earlier allows remote unauthenticated attackers to include and execute arbitrary local files on the server. The flaw is reported by Patchstack and tagged as PHP information disclosure; no public exploit identified at time of analysis, though the unauthenticated network vector makes this a meaningful priority for affected WordPress sites. Successful exploitation can expose sensitive files such as wp-config.php and may enable code execution depending on what files can be reached.
Unauthenticated local file inclusion in the ThemeRex Gunslinger WordPress theme through version 1.7 allows remote attackers to coerce PHP into including arbitrary files from the server filesystem, leading to disclosure of sensitive files and potential remote code execution where attacker-influenced content can be staged. No public exploit identified at time of analysis, but the flaw is reachable without authentication and affects all installations running version 1.7 or earlier of the theme.
Unauthenticated local file inclusion in ThemeRex Skyward WordPress theme versions 1.10 and earlier allows remote attackers to include and execute arbitrary local PHP files on the server, enabling sensitive file disclosure and potential remote code execution. The flaw is reachable without authentication over the network and no public exploit has been identified at time of analysis, though Patchstack has catalogued the issue in their vulnerability database. CVSS rates the impact as 8.1 (High) reflecting full confidentiality, integrity, and availability compromise despite high attack complexity.
Unauthenticated Local File Inclusion in the ThemeREX Granola WordPress theme through version 1.13 allows remote attackers to coerce the PHP runtime into including arbitrary files via attacker-controlled path input. The flaw is reachable over the network without credentials or user interaction and can expose sensitive site files such as wp-config.php, potentially escalating to code execution if log-poisoning or session-file techniques are viable. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Local file inclusion in the ThemeRex Gamic WordPress theme versions 1.15 and earlier allows unauthenticated remote attackers to coerce the PHP application into including arbitrary files via crafted parameters. Successful exploitation can expose sensitive configuration data (including wp-config.php) and, depending on server configuration, may escalate to remote code execution through log poisoning or session-file inclusion. No public exploit identified at time of analysis, and the issue has not been listed in CISA KEV.
Unauthenticated local file inclusion in the ThemeREX Preservation WordPress theme versions 1.10 and earlier allows remote attackers to read arbitrary files from the underlying web server, with high complexity (AC:H) but no authentication required (PR:N). The flaw, reported by Patchstack and classified as CWE-98 (improper filename control for PHP include/require statements), can lead to disclosure of sensitive files such as wp-config.php and, depending on the inclusion path, potentially full code execution. No public exploit identified at time of analysis and no KEV listing.
Unauthenticated PHP Object Injection in the ThemeREX Plumbing WordPress theme versions 1.6 and earlier allows remote attackers to inject arbitrary PHP objects via untrusted deserialization, potentially leading to full site compromise when a suitable POP gadget chain is present. No public exploit identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network attack vector make this a high-priority issue for any WordPress site running this theme.
Unauthenticated local file inclusion in the ThemeRex Fortius WordPress theme (versions 2.3.0 and earlier) allows remote attackers to include and disclose arbitrary local files on the server via a vulnerable PHP file/path parameter. The flaw maps to CWE-98 (improper control of filename for include/require) and can lead to source code disclosure, leakage of WordPress secrets in wp-config.php, and in some PHP setups remote code execution. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated local file inclusion in the ThemeRex Snow Club WordPress theme versions 1.1 and earlier allows remote attackers to include and execute arbitrary local files on the host, leading to sensitive file disclosure and potential remote code execution. The flaw is reported by Patchstack and maps to CWE-98 (PHP file inclusion); no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Unauthenticated Local File Inclusion affects the Dazzle WordPress theme (by ThemeRex) in versions up to and including 1.0.0, allowing remote attackers to read or potentially include arbitrary local files on the server. The flaw stems from improper control of filename parameters used in PHP include/require statements (CWE-98), and no public exploit has been identified at time of analysis. With a CVSS 8.1 reflecting high attack complexity but no authentication, the vulnerability is reachable by anonymous attackers but requires specific conditions to weaponize fully.
Unauthenticated local file inclusion in the ThemeREX LuxMed Medicine & Healthcare Doctor WordPress theme versions 1.2.2 and earlier allows remote attackers to include and execute arbitrary local PHP files on the server. The flaw is CWE-98 (improper control of filename for include/require) and carries CVSS 8.1 (high), though attack complexity is high; no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Unauthenticated PHP object injection in the ThemeREX Reisen WordPress theme versions 1.4.1 and earlier allows remote attackers to trigger deserialization of attacker-controlled data without authentication. Successful exploitation can lead to full site compromise via gadget chains commonly available in WordPress core or active plugins, with CVSS rated 9.8 critical. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Local File Inclusion in the Imba WordPress theme versions 1.5.0 and earlier allows remote unauthenticated attackers to read arbitrary files from the underlying server. The flaw is rooted in PHP file-inclusion handling (CWE-98) and has no public exploit identified at time of analysis, but its unauthenticated network reachability makes it a notable risk for sites still running the affected ThemeREX product.
Unauthenticated local file inclusion in the ThemeREX Tipsy WordPress theme versions 1.1 and earlier allows remote attackers to coerce the PHP interpreter into including arbitrary files via attacker-controlled path parameters. Successful exploitation can disclose sensitive server-side files, leak configuration secrets such as wp-config.php database credentials, and - depending on environment - escalate to code execution by including log files, session files, or other writable artifacts. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.
Unauthenticated Local File Inclusion in the ThemeREX Resurs WordPress theme versions 1.3 and below allows remote attackers to include and execute arbitrary local files on the server. The flaw, tracked under CWE-98 (Improper Control of Filename for Include/Require), enables disclosure of sensitive files and potential code execution depending on server configuration. No public exploit identified at time of analysis, though Patchstack has confirmed the issue against the affected theme.
Unauthenticated Local File Inclusion in the ThemeREX Orpheus WordPress theme (versions <= 1.3) allows remote attackers to read arbitrary files on the server and potentially achieve code execution via PHP file inclusion. The flaw stems from improper control of filenames in an include/require statement (CWE-98), and while no public exploit has been identified at time of analysis, the CVSS 8.1 rating reflects high impact across confidentiality, integrity, and availability. Risk is somewhat tempered by the high attack complexity metric in the CVSS vector.
Unauthenticated local file inclusion in the Snowy WordPress theme (ThemeREX) versions up to and including 1.13 allows remote attackers to coerce the PHP runtime into including arbitrary files from the server filesystem. The flaw is tracked as CWE-98 (Improper Control of Filename for Include/Require), reported by Patchstack, and carries a CVSS 3.1 score of 8.1 (High) reflecting high-complexity but unauthenticated network exploitation. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Unauthenticated local file inclusion in the ThemeREX Quirky WordPress theme versions 1.23 and earlier allows remote attackers to include and disclose arbitrary local files on the server. The flaw stems from improper control of filename for include/require statements (CWE-98), which can escalate to remote code execution if attackers can plant or reach an includable PHP payload. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated local file inclusion in the Gat WordPress theme (versions 1.16 and earlier) allows remote attackers to include arbitrary local files on the server, potentially leading to disclosure of sensitive configuration data, credentials, or remote code execution if combined with uploadable content. No public exploit identified at time of analysis, but the CVSS 8.1 rating reflects high confidentiality, integrity, and availability impact. The vulnerability is reported by Patchstack and affects the ThemeRex Gat theme.
Unauthenticated local file inclusion in the ThemeREX Ingenioso WordPress theme through version 1.14.0 allows remote attackers to coerce the PHP application into including arbitrary server-side files, leading to disclosure of sensitive content and potential remote code execution where uploaded or log-poisoned files can be reached. The flaw is classified under CWE-98 (improper control of filename for include/require) and was disclosed via Patchstack with no public exploit identified at time of analysis. CVSS is rated 8.1 (High) with high attack complexity, reflecting that successful exploitation depends on identifying a reachable include path.
Unauthenticated local file inclusion in the AirSupply WordPress theme versions up to and including 2.0.0 allows remote attackers to coerce the PHP application into including arbitrary local files, exposing sensitive data and potentially leading to code execution. Reported by Patchstack and tracked under CWE-98 (improper PHP file inclusion), with no public exploit identified at time of analysis and no EPSS or KEV signal supplied in the input. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N) indicates network-reachable, unauthenticated exploitation that nevertheless requires meeting non-trivial conditions to succeed.
Unauthenticated PHP object injection in the ThemeREX Addons WordPress plugin (versions 2.36.1.1 and earlier) allows remote attackers to inject crafted serialized objects that are deserialized by the plugin, potentially leading to remote code execution, arbitrary file operations, or full site compromise when a suitable PHP gadget chain is present. The flaw is reachable without authentication and scores CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the CVE is not currently listed in CISA KEV.
Unauthenticated local file inclusion in the ThemeRex HomeRoofer WordPress theme through version 2.11.0 allows remote attackers to include and read arbitrary local files on the server, potentially leading to source code disclosure, credential theft from wp-config.php, and in some PHP configurations remote code execution. The flaw is reachable without authentication over HTTP, and no public exploit has been identified at time of analysis though Patchstack has catalogued the issue in their WordPress vulnerability database. No CISA KEV listing or EPSS data was supplied in the source intelligence.
Unauthenticated Local File Inclusion affects the Joly WordPress theme by ThemeREX in versions up to and including 1.22.0, allowing remote attackers without credentials to coerce the PHP application into including arbitrary local files. Successful exploitation can disclose sensitive configuration (such as wp-config.php containing database credentials and auth keys) and, depending on server configuration, escalate to remote code execution via log poisoning or session file inclusion. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthenticated local file inclusion in the ThemeREX Neuronet WordPress theme before version 1.14.0 allows remote attackers to coerce the PHP runtime into including arbitrary files via untrusted input reaching an include/require statement. The flaw is reachable without authentication or user interaction, but CVSS marks attack complexity as High, suggesting non-trivial preconditions for full exploitation. No public exploit identified at time of analysis, and the issue is not on the CISA KEV list.
Local File Inclusion in the ThemeREX ITactics WordPress theme versions 1.0 and earlier allows remote unauthenticated attackers to include arbitrary files from the underlying server, leading to disclosure of sensitive configuration data and potentially PHP code execution if attacker-controlled content can be staged on the host. Tracked by Patchstack and indexed in ENISA EUVD as EUVD-2025-210182, the issue carries a CVSS 8.1 (High) score with no public exploit identified at time of analysis.
PHP object injection in the ThemeREX Royal Event WordPress theme affects versions up to and including 2.0: attacker-supplied serialized data reaching an unserialize() call can instantiate arbitrary objects. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, 9.8) describes a network-reachable, low-complexity, unauthenticated flaw with full confidentiality, integrity and availability impact, and the vuln.today decision label is act_now. No public exploit code or CISA KEV entry is reported in the available data, and the actual impact hinges on whether a usable POP gadget chain exists in the theme, WordPress core or an installed plugin; the specific triggering endpoint and parameter are not described in the available sources.
Gunslinger WordPress theme through version 1.11 exposes an unauthenticated PHP object injection issue that can let remote attackers supply serialized input to a PHP object deserialization path, carrying high confidentiality, integrity, and availability impact if a usable gadget chain is present. The CVSS vector confirms network reachability with no privileges or user interaction, but the exact vulnerable parameter or endpoint is not described in the available sources. No public exploit is identified at time of analysis, no fixed version is stated, and the vuln.today decision label is act_now.
Unauthenticated PHP object injection in the ThemeRex Good Homes WordPress theme through version 1.3.13 can allow remote attackers to supply serialized data that may cause high confidentiality, integrity, and availability impact if a usable POP gadget chain exists in the theme, an installed plugin, or WordPress core. The CVSS 3.1 score is 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and vuln.today assigns an act_now priority. The provided data does not identify public exploit code or confirm CISA KEV active exploitation, and it does not confirm that a usable gadget chain or the specific vulnerable input is present.
Unauthenticated PHP object injection in the ThemeREX Gamic WordPress theme through version 1.19 lets remote attackers supply crafted serialized input to a deserialization sink, and the CVSS 9.8 vector indicates high confidentiality, integrity, and availability impact. The vulnerability class is CWE-502; full code-execution impact depends on a usable PHP gadget chain, and the specific vulnerable parameter or endpoint is not described in the available sources. The provided intelligence has no CISA KEV listing or public exploit identified at time of analysis, while the vuln.today decision label is act_now.
Unauthenticated PHP object injection in the ThemeREX Gamezone WordPress theme through version 1.1.11 can let remote attackers influence deserialization on sites where the vulnerable theme is active, with the supplied CVSS vector indicating high confidentiality, integrity, and availability impact. Exploitation requires Gamezone to be installed and active, and the available sources do not describe the trigger or confirm a usable POP gadget chain, so realized impact may be narrower than the 9.8 base score. No public exploit identified at time of analysis, but the intelligence decision label is act_now.
Unauthenticated PHP object injection in the ThemeRex EmojiNation WordPress theme through version 1.0.12 allows remote attackers to pass crafted serialized input into a reachable theme endpoint, scored 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and rated act_now by vuln.today priority. Success depends on whether an exploitable PHP gadget chain is loaded via the theme, an active plugin, or WordPress core; without a usable chain the practical result may be limited to a crash or be non-exploitable, and the vulnerable parameter and trigger are not described in the available sources. No public exploit code and no CISA KEV entry are associated with this CVE at time of analysis, and the reporting rests on a single source (Patchstack).
Unauthenticated PHP object injection in the ThemeRex Edge Decor WordPress theme through version 2.9 can let remote attackers feed crafted serialized data into PHP object deserialization on affected sites. The issue carries CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and an act_now priority label, but impact beyond object injection depends on a usable POP gadget chain in the theme, plugins, or WordPress core. Only sites with this specific theme installed and active are exposed, and the provided intelligence contains no KEV status or public exploit reference; no public exploit was identified at time of analysis.
Unauthenticated PHP object injection in the Coinpress WordPress theme through version 1.0.15 allows remote attackers to pass crafted serialized data to the theme, with the supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) indicating full confidentiality, integrity, and availability impact and no authentication or user interaction requirement. The vuln.today Decision label is act_now and the finding is reported by Patchstack, but the available sources do not name the vulnerable parameter or endpoint and do not confirm a reachable POP gadget chain, so file-write or code-execution impact is conditional on such a chain existing in the theme, co-installed plugins, or WordPress core. No public exploit is identified in the supplied data.
PHP object injection in the ThemeRex Bonbon WordPress theme through version 1.11 is reachable without authentication or user interaction, and the supplied CVSS 3.1 vector rates it 9.8 with high confidentiality, integrity, and availability impact. The practical impact depends on a usable gadget chain in the theme, WordPress core, or a co-installed plugin; the deserialization entry point and whether a working gadget chain is publicly available are not described in the available sources. No public exploit was identified in the supplied data at time of analysis, no fixed version is stated, and the vuln.today decision label is act_now.
Unauthenticated PHP object injection in the Avventure WordPress theme through version 1.1.12 gives remote attackers a route to supply serialized data to an unserialize() sink, with CVSS 3.1 scored 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and a vuln.today priority decision of act_now. The available sources do not identify the specific theme endpoint or parameter that reaches the sink, and they do not confirm that a usable gadget chain is present for full code execution. No public exploit was identified in the provided data at time of analysis.
Unauthenticated PHP Object Injection in the Filmax WordPress theme through version 1.1.11 lets remote attackers reach deserialization logic without credentials or user interaction, carrying a 9.8 Critical CVSS score and an act_now priority from vuln.today. Impact is full confidentiality, integrity and availability loss per the assessed vector, although real-world damage depends on a usable POP gadget chain being reachable through the theme, an active plugin, or WordPress core; the available sources do not describe the injection vector or confirm such a chain, so the trigger is not described in the available sources. No public exploit code or active exploitation is confirmed at time of analysis, and the only supplied reference is Patchstack's vulnerability entry for the theme.
Unauthenticated PHP object injection in the ThemeRex Orpheus WordPress theme, affecting versions 1.8 and earlier, lets remote attackers reach unsafe deserialization of attacker-supplied data, carrying an assessed CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) against confidentiality, integrity and availability. The exact injection point, endpoint or feature that reaches the unsafe unserialize call is not described in the available sources, and real-world impact depends on a usable PHP gadget (POP) chain existing in the theme, WordPress core, or co-installed plugins, which the sources do not confirm. No public exploit code or CISA KEV entry was identified at time of analysis, but the issue is prioritized act_now in vuln.today's decision signals and was reported through Patchstack.
Unauthenticated PHP object injection in the ThemeREX 'Nuts' WordPress theme (versions up to and including 1.12) lets remote attackers pass crafted serialized data into a PHP unserialize() path without any credentials, rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) by the reporter. Actual exploitation success is conditional: the practical impact depends on a usable POP/gadget chain being present in the theme or in co-installed plugins or WordPress core, and the available sources do not confirm such a chain or identify the exact request/feature that reaches the deserialization sink. No public exploit code is confirmed and the CVE is not in CISA KEV, although the vuln.today decision label is act_now, so this should be treated as a high-priority patch item for sites running the theme rather than as an actively exploited emergency.
Unauthenticated PHP object injection in the ThemeRex Muzicon WordPress theme through version 1.15 allows remote attackers to pass attacker-controlled serialized data into an unserialize() sink without any credentials, which can corrupt application state or escalate to code execution if a usable gadget chain is reachable. The vulnerability carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is tracked under CWE-502; no public exploit code has been reported, it is not listed in CISA KEV, and no EPSS figure was supplied. The practical limiting factor is the need for a POP chain in the theme, WordPress core, or a co-installed plugin, and the precise vulnerable endpoint and parameter are not described in the available sources.
PHP object injection in the commercial WordPress theme Motorix (ThemeRex) at version 1.11 and earlier lets unauthenticated remote attackers pass serialized input that reaches a PHP unserialize() call, potentially instantiating arbitrary objects and - if a usable POP gadget chain is present in the theme, its bundled plugins or WordPress core - escalating to code execution or full site compromise. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) rates confidentiality, integrity and availability impact as high, and the vuln.today decision label is act_now, so it should be handled as a near-term patching priority rather than a high-score-but-low-risk item. No CISA KEV entry and no public exploit code were identified in the available sources at time of analysis, and the input parameter and gadget chain involved are not described.
Unauthenticated PHP object injection in the ThemeREX Mission theme for WordPress, versions up to and including 1.22, lets remote attackers feed attacker-controlled serialized data into a PHP deserialization sink, carrying a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with maximal confidentiality, integrity and availability impact. Only sites running this specific theme at 1.22 or earlier are exposed, which limits the attackable population, but no login or user interaction is required to reach the flaw. The issue was reported through Patchstack and is rated act_now by vulnerability intelligence; the supplied data contains no CISA KEV entry and no confirmed working exploit code, so no public exploit is identified at time of analysis, and the supplier did not identify the specific injectable parameter or a usable gadget chain, meaning realized impact may vary site by site.
PHP object injection in ThemeRex's Meals & Wheels theme through version 1.1.13 is remotely reachable without authentication or user interaction and is rated 9.8 CVSS. The entry point and trigger are not described in the available sources, and real-world impact depends on a reachable POP gadget chain that the evidence does not confirm; no public exploit was identified at time of analysis. Patchstack reported the flaw, and no fixed version is listed in the provided evidence.
Unauthenticated PHP object injection in the ThemeRex Marcell WordPress theme through version 1.2.14 allows remote attackers to supply attacker-controlled serialized data to a PHP deserialization path, with a CVSS 3.1 score of 9.8 and CWE-502. The CVSS vector indicates remote, low-complexity, unauthenticated exploitation with no user interaction, and the vuln.today priority decision is act_now. No public exploit was identified at time of analysis, and the practical impact depends on whether a reachable POP gadget chain exists in the theme or installed plugins; the trigger endpoint or parameter is not described in the available sources.
Signals conflict in a way worth stating plainly: the Le Truffe WordPress theme through version 1.1.7 contains an unauthenticated PHP object injection (CWE-502) scored CVSS 9.8, but whether it yields code execution or other high-impact actions depends on a suitable POP gadget chain in the loaded WordPress core, plugins, or theme code. Patchstack is the reporting source and the vuln.today decision label is act_now; no public exploit identified at time of analysis, and the vulnerable parameter and endpoint are not described in the supplied data.
PHP object injection in the ThemeRex Legal Stone WordPress theme through version 1.2.11 allows unauthenticated remote attackers to pass crafted serialized data into the theme's PHP deserialization path, which the vendor-issued CVSS 3.1 vector rates 9.8 (AV:N/AC:L/PR:N/UI:N, C/I/A High) and which the priority assessment labels act_now. Because this is a theme rather than a self-contained application, meaningful post-injection impact depends on a usable POP gadget chain being reachable in the theme or in co-installed plugins, and the supplied sources do not identify the injectable endpoint or any specific gadget chain. No CISA KEV entry, no confirmed active exploitation and no public exploit code were identified in the provided intelligence at time of analysis, so the high score reflects worst-case potential on unpatched sites rather than observed attacks.
Ozisti WordPress theme 1.1.10 and earlier carries an unauthenticated PHP object injection issue rated CVSS 9.8, and the vuln.today decision label is act_now; the finding is reported by Patchstack. The CVSS vector indicates network reachability with no privileges or user interaction, but the available sources do not describe the specific injection point or confirm that an exploitable PHP gadget chain is present. No public exploit was identified at time of analysis, and no KEV active-exploitation signal is present in the provided data.
Unauthenticated PHP object injection in the ThemeREX Preservation WordPress theme through version 1.15 can let remote attackers supply serialized input that the theme deserializes, with a CVSS 9.8 rating reflecting potential high confidentiality, integrity, and availability impact. Exploitation requires a WordPress site running the affected theme, and while the vector shows no authentication or user interaction, the available sources do not confirm a usable gadget chain or identify the vulnerable endpoint and parameter. No public exploit was identified at time of analysis, but the act_now priority and severe rating warrant prompt verification against the Patchstack advisory.
Unauthenticated PHP object injection in the Printy WordPress theme through version 1.13.0 lets remote attackers supply serialized data to a PHP deserialization point without credentials or user interaction, carrying a CVSS 9.8 rating and an act_now priority. The supplied intelligence does not identify active exploitation (no CISA KEV entry) or public exploit code, and real-world impact depends on whether a usable POP gadget chain exists in Printy or a co-installed plugin because the vulnerable parameter and trigger are not described. Sites running Printy 1.13.0 or earlier should be treated as exposed until a fixed release is confirmed.
Unauthenticated PHP object injection affects the ThemeRex Quirky WordPress theme through version 1.23, with a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). A remote attacker can reach the flaw without authentication, but the vulnerable parameter and endpoint are not identified in the available sources, and meaningful compromise depends on a usable POP gadget chain in the theme, WordPress core, or an installed plugin. No public exploit or confirmed active exploitation was identified at time of analysis, and the provided priority label is act_now.
Unauthenticated PHP object injection in the ThemeRex RexCoin WordPress theme at version 1.2.6 and earlier allows remote attackers to reach the theme's deserialization path without credentials and without user interaction, carrying a CVSS 3.1 score of 9.8 with high confidentiality, integrity and availability impact. Realized impact hinges on whether a usable gadget/POP chain is reachable in the theme or a co-installed plugin, a condition the available sources do not confirm, and the specific request, parameter or sink that triggers the injection is likewise not described. No public exploit code was identified at time of analysis, no fixed version is listed in the available data, and the vuln.today priority is act_now based largely on a single Patchstack source.
PHP object injection through deserialization of untrusted data affects the ThemeREX ZenSoul WordPress theme at all versions through 1.13, exposed over the network with a CVSS score of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) per the supplied vector. The available sources do not identify the specific endpoint, parameter, or theme feature that reaches the unsafe deserialization, nor whether a usable POP gadget chain exists in the theme, WordPress core, or installed plugins - a factor that typically governs whether object injection escalates to code execution, file operations, or data disclosure. No confirmation of active exploitation (CISA KEV) or verified working exploit code was provided; a public reference exists at the Patchstack vulnerability database entry, and the site's priority label is act_now.
Unauthenticated PHP Object Injection in the Buzz Stone | Magazine & Viral Blog WordPress theme (vendor themerex) at versions 1.0.2 and earlier lets any remote attacker who can reach an affected request path supply serialized PHP data that the theme passes into an unsafe unserialize() call, yielding a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact). Because the attack is unauthenticated and requires no user interaction, exploitation depends only on the site running this specific niche theme and on a usable POP gadget chain being reachable in the theme, WordPress core, or a co-installed plugin; absent such a gadget, impact is limited to object-injection side effects rather than full remote code execution. No public exploit code has been identified at time of analysis, and the primary limiting factor is narrow deployment - only sites running this particular theme are exposed.
PHP object injection in the Photolia WordPress theme (versions <= 1.0.3) allows unauthenticated remote attackers to trigger deserialization of untrusted data, potentially leading to code execution, file manipulation, or data theft if a usable POP gadget chain exists in the WordPress environment. Although rated CVSS 9.8, the practical risk is tempered by the requirement for a reachable gadget chain in core or co-installed components, and no public exploit has been identified at time of analysis. Site owners should treat this as high severity but prioritize based on exposure.
Unauthenticated PHP object injection in the ThemeREX Jacqueline WordPress theme (versions 2.22 and earlier) can let remote attackers achieve full confidentiality, integrity, and availability impact (CVSS 9.8) if a usable POP gadget chain is reachable in the theme or other installed WordPress components. Exploitation requires no authentication or user interaction against a site with the theme active, but the practical impact depends on the presence of a viable gadget chain. No public exploit has been identified at time of analysis, and no vendor-released patch was found in the provided data.
Unauthenticated PHP Object Injection in the ThemeREX Alliance WordPress theme (versions 3.11 and earlier) allows remote attackers to pass crafted serialized data into a PHP unserialize() call, which can lead to arbitrary object instantiation and, where a usable POP gadget chain exists, full compromise of the underlying site with high impact to confidentiality, integrity and availability. The vulnerability carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), so no authentication or user interaction is required and default installations are reachable over the network; at time of analysis no public exploit code has been identified and the issue is not listed in CISA KEV, though the EPSS-style risk profile of an unauthenticated WordPress theme flaw of this class typically rises quickly once details circulate. Practical impact depends on the presence of a reachable gadget chain in the theme, WordPress core, or other installed plugins; sites without such a chain may see reduced, but still material, exposure because the injection primitive itself is remotely reachable.
Unauthenticated PHP object injection in the ThemeREX ShiftCV WordPress theme, affecting versions up to and including 3.0.14, lets remote attackers feed crafted serialized input into an unsafe deserialization sink, which can escalate to remote code execution when a usable POP gadget chain is reachable in the theme, WordPress core, or an installed plugin. The flaw carries a 9.8 Critical rating (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication and no user interaction are required and successful exploitation can fully compromise confidentiality, integrity and availability. There is no public exploit identified at time of analysis and no CISA KEV confirmation, so the practical limiting factor is the availability of a reachable gadget chain rather than the injection primitive itself; no EPSS score was supplied in the available intelligence.
Unauthenticated PHP object injection in the WordPress theme Windsor (ThemeREX) through version 2.10 lets remote attackers feed crafted serialized data into an unserialize() call reachable without authentication or user interaction, scoring a maximum base 9.8 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Reported by Patchstack and tracked as CWE-502, the flaw's realized impact depends on whether a usable PHP gadget chain exists across the theme, WordPress core, and installed plugins - in an unpatched site with a suitable gadget, this can escalate to code execution, arbitrary file or data manipulation, whereas without one the injection may be largely inert. At time of analysis there is no public exploit code identified and no CISA KEV listing, so exploitation is not confirmed in the wild; no vendor-released fix version appears in the available advisory data. Given the unauthenticated, network-reachable profile and the prevalence of gadget-rich plugin stacks, this should be treated as high priority for any site running the theme.
Unauthenticated PHP object injection in the ThemeRex Education Center WordPress theme (versions up to and including 3.6.12) lets remote attackers feed serialized data into an unserialize() sink with no authentication and no user interaction, scored CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Actual damage depends on whether a usable POP gadget chain exists in the theme, WordPress core, or co-installed plugins, because that determines whether object injection escalates to code execution or full confidentiality, integrity, and availability loss. No public exploit code and no CISA KEV listing were identified at time of analysis, and real-world exposure is constrained by the narrow installed base of this specific commercial theme.
Unauthenticated PHP object injection in the ThemeRex 'Asia Garden' WordPress theme (versions 1.3.1 and earlier) allows remote attackers to pass crafted serialized data into PHP's unserialize() and instantiate arbitrary objects on the target site. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8 Critical), exploitation requires no authentication or user interaction against an affected installation and could yield full confidentiality, integrity, and availability impact - typically arbitrary code execution, file manipulation, or SQL injection when a usable POP gadget chain exists in the theme, WordPress core, or an active plugin. No public exploit code has been identified at time of analysis, and the flaw is not confirmed as actively exploited (CISA KEV); no EPSS score was supplied. Practical exploitability hinges on the presence of a viable gadget chain, without which impact may drop to denial of service or be difficult to weaponize, and the exact vulnerable parameter/endpoint is not detailed in the available data.
Unauthenticated PHP object injection in the WordPress theme N7 | Golf Club Sports & Events (versions 2.21 and earlier, vendor ThemeREX) lets a remote attacker supply a crafted serialized PHP object to a theme endpoint without any authentication or user interaction, yielding a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H). Because no public exploit code and no CISA KEV entry were identified at time of analysis, real-world impact hinges on whether a usable POP gadget chain exists in the theme, WordPress core, or a co-installed plugin; where such a chain is reachable, the deserialization flaw can escalate to full remote code execution. Exposure is limited to sites that have this specific niche golf/sports theme installed and active, but for those sites the worst-case profile is complete compromise by an unauthenticated attacker.
Unauthenticated PHP object injection in the ThemeRex Invetex WordPress theme affects versions 2.18 and earlier, allowing remote attackers to supply crafted serialized input to a theme endpoint that performs unsafe deserialization. Successful exploitation can lead to full compromise of the confidentiality, integrity, and availability of the affected site, but the practical ceiling depends on whether a usable PHP POP gadget chain exists in the theme, an active plugin, or WordPress core. No public exploit code or confirmed active exploitation was identified at time of analysis, and the CVSS score should be weighed against the assessed AC:H rather than the reported AC:L.
Unauthenticated PHP object injection in the ThemeRex 'Law Office' WordPress theme at version 3.20 and earlier lets remote attackers with no credentials and no user interaction pass attacker-controlled serialized data into an unsafe unserialize() path, which the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) scores as complete loss of confidentiality, integrity and availability. Practical impact depends heavily on whether a usable POP gadget chain exists in the theme, an installed plugin, or WordPress core; without a reachable gadget the result may be far below the theoretical 9.8 headline score. No CISA KEV entry, EPSS score, or public exploit code is present in the available intelligence, so this is assessed as no public exploit identified at time of analysis, and exposure is limited to sites running this commercial legal-industry theme.
Unauthenticated PHP object injection in the ThemeRex WineShop WordPress theme (all versions up to and including 3.20) lets remote attackers push attacker-controlled serialized data into a PHP unserialize() operation, enabling instantiation of arbitrary PHP objects and - where a usable gadget chain exists in the theme, co-installed plugins, or the runtime - remote code execution, arbitrary file read/write, or SQL injection. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N), meaning exploitation against a default installation requires no authentication and no user interaction, per the published PR:N/UI:N vector. At time of analysis there is no public exploit code identified and the theme is not listed in CISA KEV; practical exposure is limited to sites actually running this niche wine-shop theme and by whether an exploitable POP gadget chain is reachable.
Unauthenticated PHP object injection in the ThemeRex Equadio WordPress theme (versions up to and including 1.1.4) allows remote attackers to supply crafted serialized input to vulnerable deserialization entry points, potentially leading to remote code execution, file deletion, or other high-impact outcomes depending on available gadget chains. The flaw carries a CVSS 3.1 base score of 9.8, reflecting network exploitability with low complexity, no authentication, and no user interaction required. No public exploit code or active exploitation has been identified at time of analysis, though the severity and ease of exploitation make prompt patching critical.
Unauthenticated PHP Object Injection in the ThemeRex 'Juno' WordPress theme affects all versions up to and including 2.25, allowing remote attackers to supply a crafted serialized PHP object that the theme deserializes without validation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) rates this as a network-reachable, low-complexity flaw requiring no credentials and no user interaction, with high confidentiality, integrity and availability impact; however, real-world impact depends on whether a usable POP gadget chain exists in the theme or in co-installed plugins, which is not confirmed in the available data. No public exploit code and no confirmed active exploitation were identified at time of analysis (Patchstack is credited as the reporting source), and exploitation is limited to the subset of WordPress sites running this specific commercial theme at an affected version.
Unauthenticated local file inclusion in the Ozeum WordPress theme (ThemeREX) through version 1.3.0 allows remote attackers to control a PHP include/require path and read arbitrary files on the hosting server, potentially exposing wp-config.php database credentials, API keys, and other sensitive content. Patchstack reports this as a High-severity issue at CVSS 8.1, while the independent assessment keeps attack complexity High (AC:H) and lowers integrity and availability impact to Low (C:H/I:L/A:L), meaning reliable exploitation hinges on conditions the attacker does not fully control and the realistic exposure is confined to sites running this specific theme at or below 1.3.0. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Unauthenticated PHP object injection in the ThemeRex 'Yacht Rental' WordPress theme affects all versions up to and including 2.6, allowing a remote attacker to pass crafted serialized data into a PHP deserialization path without credentials or user interaction. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N), the theoretical worst case is high confidentiality, integrity, and availability impact with a 9.8 base score. No public exploit code has been identified at time of analysis, and the practical severity depends on whether a usable PHP gadget chain exists within the theme, WordPress core, or co-installed plugins - without such a gadget, real-world impact may be reduced.
Unauthenticated PHP Object Injection in the Wine House WordPress theme (version 3.20 and earlier, distributed by ThemeREX) allows a remote attacker to deliver a crafted serialized payload to an unserialize() call, which the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates at 9.8 Critical with full Confidentiality, Integrity, and Availability impact. Because PR:N and UI:N are confirmed by the vector, no authentication or victim interaction is required - any unauthenticated request to the affected endpoint against a site with the theme installed and active can carry the payload. No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical severity is bounded by whether a usable POP gadget chain exists in the theme, WordPress core, or co-installed plugins; absent such a gadget, impact may degrade to denial of service or be non-exploitable, and the target population is limited to sites running this single commercial theme.
Unauthenticated PHP object injection in the ThemeREX Tipsy WordPress theme through version 1.6 allows remote attackers to supply crafted serialized data that the theme passes to PHP unserialize(), potentially leading to remote code execution, file manipulation, or SQL injection where a usable POP gadget chain exists. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N), the flaw is network-reachable, low-complexity, and requires neither authentication nor user interaction, with full confidentiality, integrity, and availability impact (9.8). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; exploitation is constrained by the need for an exploitable gadget chain in the theme, WordPress core, or an active plugin.
Unauthenticated PHP object injection in the Stargaze WordPress theme (versions 1.10 and earlier) allows remote attackers to submit a crafted serialized payload that the theme feeds to PHP's unserialize(), which can trigger arbitrary object instantiation and, where a usable gadget chain is present, code execution or full site compromise; the maximum-base CVSS 3.1 score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects high confidentiality, integrity, and availability impact. Per that vector no authentication (PR:N) and no user interaction (UI:N) are required, and the CPE record cpe:2.3:a:themerex:stargaze ties the exposure to the ThemeREX Stargaze theme, so only sites with this theme installed and active are in scope. At time of analysis there is no public exploit identified, and the practical ceiling on impact depends on whether a viable POP gadget chain exists in the theme itself, a co-installed plugin, or WordPress core.
Unauthenticated PHP object injection in the ThemeRex Splendour WordPress theme (versions 1.23 and earlier) lets remote attackers pass crafted serialized data into an unsafe deserialization routine, which can lead to remote code execution, arbitrary file manipulation, or full site takeover if a usable gadget chain is reachable. The flaw carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is classified as CWE-502 Deserialization of Untrusted Data; the vector confirms the entry point is reachable over the network with no authentication and no user interaction. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited, so real-world impact hinges on the presence of a POP gadget chain in the theme, co-installed plugins, or WordPress core, and on the narrow deployment footprint of this specific commercial theme.
Reflected cross-site scripting (XSS) in the ThemeREX Education Center WordPress theme (versions up to and including 3.6.12) allows remote attackers to execute arbitrary JavaScript in a victim's browser when they click a crafted link. The flaw requires user interaction (UI:R) and no authentication (PR:N), and it is reported by Patchstack with a CVSS 3.1 base score of 7.1; however, our assessment indicates no availability impact (A:N), limiting the impact to confidentiality and integrity of the victim's session. No public exploit code or active exploitation has been identified at time of analysis.
Reflected cross-site scripting in the ThemeREX Addons WordPress plugin affects all versions below 2.45.0, allowing an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser within the affected site's origin. Exploitation requires user interaction (CVSS vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base score 7.1): the attacker must lure a victim to a crafted link or attacker-influenced page that triggers the injected payload, and success also depends on the site lacking a WAF or the patched plugin. There is no public exploit code identified at time of analysis and no confirmed active exploitation; impact is confined to the victim's browser session (low confidentiality, integrity and availability) rather than direct server compromise.
Unauthenticated PHP Object Injection in the ThemeREX Addons (trx_addons) WordPress plugin before 2.45.0 lets remote attackers inject arbitrary serialized PHP objects into the application. Because no authentication is required (CVSS 9.8, PR:N/UI:N), an attacker can supply crafted serialized data to a vulnerable entry point; when combined with a suitable POP gadget chain present in the plugin, another plugin, a theme, or WordPress core, this can escalate to code execution, arbitrary file operations, or data compromise. Reported by Patchstack; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Insecure deserialization in the Abelle WordPress theme (ThemeREX) versions 1.22 and earlier lets unauthenticated remote attackers inject crafted PHP objects that the application deserializes, enabling PHP Object Injection. Because attacker-supplied serialized data reaches unsafe unserialize() logic without authentication, an adversary can potentially achieve remote code execution, data tampering, or full site compromise depending on available gadget chains in WordPress core, the theme, or co-installed plugins. There is no public exploit identified at time of analysis, but the flaw carries a CVSS 9.8 rating reflecting network-reachable, unauthenticated, high-impact exploitation.
Broken access control in the Booked WordPress appointment-scheduling plugin (versions <= 3.0.0, by ThemeRex) lets low-privileged authenticated users (Subscriber role) reach functionality or data they should not, resulting in high confidentiality exposure and limited integrity impact per the CVSS vector. The flaw stems from missing authorization checks (CWE-862) on plugin actions, so any registered site user can abuse it. No public exploit is identified at time of analysis and it is not listed in CISA KEV; the issue was reported through Patchstack.
Unauthenticated Local File Inclusion in ThemeREX EcoBlue WordPress theme versions 1.15 and earlier enables remote attackers to include arbitrary local files on the server without credentials, potentially leading to source code disclosure and remote code execution via PHP file inclusion (CWE-98). No public exploit identified at time of analysis, but the unauthenticated network-reachable nature combined with WordPress's broad deployment surface makes this notable. EPSS data was not provided, and the issue is not listed in CISA KEV.
Unauthenticated Local File Inclusion in the ThemeREX AutoParts WordPress theme versions 1.5.8 and earlier allows remote attackers to include and execute arbitrary local files on the server. No public exploit identified at time of analysis, but the CWE-98 classification and PR:N CVSS vector make this a meaningful pre-authentication risk for any WordPress site running the theme. Successful exploitation typically leads to sensitive file disclosure (wp-config.php) and, when combined with log poisoning or uploaded content, full remote code execution.
A PHP Object Injection vulnerability exists in the ThemeREX Buisson WordPress theme through version 1.1.11, stemming from unsafe deserialization of untrusted data (CWE-502). This flaw allows attackers to inject malicious serialized objects that can lead to arbitrary code execution or other object manipulation attacks depending on available gadget chains in the WordPress environment. While no CVSS score or EPSS data is currently published and the vulnerability has not been listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, the public disclosure via Patchstack indicates active awareness in the security community.
A PHP Object Injection vulnerability exists in the ThemeREX Work & Travel Company WordPress theme through version 1.2, stemming from unsafe deserialization of untrusted data (CWE-502). An attacker can exploit this vulnerability to inject malicious objects into the application, potentially leading to remote code execution or arbitrary object manipulation depending on the gadget chains available in the WordPress environment. No CVSS score, EPSS data, or KEV status is currently available, and the vulnerability was identified and reported by Patchstack, though active exploitation status remains unclear.
A PHP Object Injection vulnerability exists in ThemeREX Love Story WordPress theme through version 1.3.12, stemming from unsafe deserialization of untrusted data. This vulnerability allows attackers to inject malicious serialized objects that can lead to remote code execution or other object-oriented attack chains. The vulnerability is classified as CWE-502 (Deserialization of Untrusted Data) and has been reported by Patchstack; no CVSS score or EPSS data is currently available, and KEV status is unknown.
A security vulnerability in ThemeREX ProLingua prolingua allows PHP Local File Inclusion (CVSS 8.1). High severity vulnerability requiring prompt remediation.
A Local File Inclusion (LFI) vulnerability exists in the ThemeREX Nelson WordPress theme through version 1.2.0, allowing attackers to read arbitrary files from the affected server. The vulnerability stems from improper control of filenames in PHP include/require statements (CWE-98), enabling information disclosure attacks without authentication. While no CVSS score or EPSS data is currently available, the LFI classification and public disclosure via Patchstack indicate this is a genuine security concern affecting WordPress installations using vulnerable Nelson theme versions.
A Local File Inclusion (LFI) vulnerability exists in the ThemeREX Good Homes WordPress theme through version 1.3.13, allowing attackers to include and execute arbitrary local files on the affected server. The vulnerability stems from improper control of filenames in PHP include/require statements (CWE-98), enabling unauthenticated attackers to disclose sensitive information or achieve remote code execution by accessing system files. No CVSS score, EPSS data, or active KEV designation was reported, but the LFI classification and information disclosure impact indicate this requires prompt patching.
A PHP Local File Inclusion vulnerability exists in the ThemeREX Melania WordPress theme, allowing remote attackers to include and execute arbitrary local files on the server. All versions up to and including 2.5.0 are affected. The CVSS score of 8.1 indicates high severity with network-based attack vector, though attack complexity is rated as high; there is no evidence of active exploitation (not in KEV) or public proof-of-concept at this time.
Cross-site scripting in ThemeREX Addons (the trx_addons WordPress plugin) below version 2.45.0 lets an authenticated attacker with only a Subscriber-level account inject script content that executes in the browser of any higher-privileged user who views it, enabling session theft or actions performed in the victim's context. Reaching the vulnerable input requires a Subscriber account - trivially obtainable when open WordPress registration is enabled - and successful exploitation is further gated by victim interaction, so an unauthenticated remote attacker cannot exploit a hardened site with registration disabled. No public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated CSRF in Booked WordPress plugin (versions <= 3.0.0) enables remote attackers to trigger availability-impacting actions against authenticated WordPress users without their consent. The CVSS vector (C:N/I:N/A:H) indicates this CSRF leads to a destructive availability outcome - likely deletion or corruption of booking/scheduling data - rather than data theft or code execution. No public exploit or active exploitation has been identified at time of analysis, though the low attack complexity and no required privileges for staging the attack make social-engineering delivery straightforward.
Unauthenticated local file inclusion in the Line Agency WordPress theme versions 1.3.1 and earlier allows remote attackers to include and disclose arbitrary local files on the underlying server, potentially leading to sensitive data exposure and, depending on PHP configuration, remote code execution. The flaw is reported by Patchstack and is mapped to CWE-98 (PHP Remote File Inclusion), with no public exploit identified at time of analysis and no listing in the CISA KEV catalog.
Unauthenticated local file inclusion in the ThemeREX Etude WordPress theme versions 1.6 and earlier allows remote attackers to coerce the application into including arbitrary PHP files, potentially leading to source disclosure, sensitive data exposure, and possible remote code execution depending on writable locations on the host. The high CVSS score of 8.1 reflects significant confidentiality, integrity, and availability impact, though the high attack complexity (AC:H) suggests non-trivial preconditions; no public exploit identified at time of analysis.
Local File Inclusion in the ThemeRex Eventicity WordPress theme versions 1.5 and earlier allows remote unauthenticated attackers to include and execute arbitrary local files on the server. The flaw is reported by Patchstack and tagged as PHP information disclosure; no public exploit identified at time of analysis, though the unauthenticated network vector makes this a meaningful priority for affected WordPress sites. Successful exploitation can expose sensitive files such as wp-config.php and may enable code execution depending on what files can be reached.
Unauthenticated local file inclusion in the ThemeRex Gunslinger WordPress theme through version 1.7 allows remote attackers to coerce PHP into including arbitrary files from the server filesystem, leading to disclosure of sensitive files and potential remote code execution where attacker-influenced content can be staged. No public exploit identified at time of analysis, but the flaw is reachable without authentication and affects all installations running version 1.7 or earlier of the theme.
Unauthenticated local file inclusion in ThemeRex Skyward WordPress theme versions 1.10 and earlier allows remote attackers to include and execute arbitrary local PHP files on the server, enabling sensitive file disclosure and potential remote code execution. The flaw is reachable without authentication over the network and no public exploit has been identified at time of analysis, though Patchstack has catalogued the issue in their vulnerability database. CVSS rates the impact as 8.1 (High) reflecting full confidentiality, integrity, and availability compromise despite high attack complexity.
Unauthenticated Local File Inclusion in the ThemeREX Granola WordPress theme through version 1.13 allows remote attackers to coerce the PHP runtime into including arbitrary files via attacker-controlled path input. The flaw is reachable over the network without credentials or user interaction and can expose sensitive site files such as wp-config.php, potentially escalating to code execution if log-poisoning or session-file techniques are viable. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Local file inclusion in the ThemeRex Gamic WordPress theme versions 1.15 and earlier allows unauthenticated remote attackers to coerce the PHP application into including arbitrary files via crafted parameters. Successful exploitation can expose sensitive configuration data (including wp-config.php) and, depending on server configuration, may escalate to remote code execution through log poisoning or session-file inclusion. No public exploit identified at time of analysis, and the issue has not been listed in CISA KEV.
Unauthenticated local file inclusion in the ThemeREX Preservation WordPress theme versions 1.10 and earlier allows remote attackers to read arbitrary files from the underlying web server, with high complexity (AC:H) but no authentication required (PR:N). The flaw, reported by Patchstack and classified as CWE-98 (improper filename control for PHP include/require statements), can lead to disclosure of sensitive files such as wp-config.php and, depending on the inclusion path, potentially full code execution. No public exploit identified at time of analysis and no KEV listing.
Unauthenticated PHP Object Injection in the ThemeREX Plumbing WordPress theme versions 1.6 and earlier allows remote attackers to inject arbitrary PHP objects via untrusted deserialization, potentially leading to full site compromise when a suitable POP gadget chain is present. No public exploit identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network attack vector make this a high-priority issue for any WordPress site running this theme.
Unauthenticated local file inclusion in the ThemeRex Fortius WordPress theme (versions 2.3.0 and earlier) allows remote attackers to include and disclose arbitrary local files on the server via a vulnerable PHP file/path parameter. The flaw maps to CWE-98 (improper control of filename for include/require) and can lead to source code disclosure, leakage of WordPress secrets in wp-config.php, and in some PHP setups remote code execution. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated local file inclusion in the ThemeRex Snow Club WordPress theme versions 1.1 and earlier allows remote attackers to include and execute arbitrary local files on the host, leading to sensitive file disclosure and potential remote code execution. The flaw is reported by Patchstack and maps to CWE-98 (PHP file inclusion); no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Unauthenticated Local File Inclusion affects the Dazzle WordPress theme (by ThemeRex) in versions up to and including 1.0.0, allowing remote attackers to read or potentially include arbitrary local files on the server. The flaw stems from improper control of filename parameters used in PHP include/require statements (CWE-98), and no public exploit has been identified at time of analysis. With a CVSS 8.1 reflecting high attack complexity but no authentication, the vulnerability is reachable by anonymous attackers but requires specific conditions to weaponize fully.
Unauthenticated local file inclusion in the ThemeREX LuxMed Medicine & Healthcare Doctor WordPress theme versions 1.2.2 and earlier allows remote attackers to include and execute arbitrary local PHP files on the server. The flaw is CWE-98 (improper control of filename for include/require) and carries CVSS 8.1 (high), though attack complexity is high; no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Unauthenticated PHP object injection in the ThemeREX Reisen WordPress theme versions 1.4.1 and earlier allows remote attackers to trigger deserialization of attacker-controlled data without authentication. Successful exploitation can lead to full site compromise via gadget chains commonly available in WordPress core or active plugins, with CVSS rated 9.8 critical. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Local File Inclusion in the Imba WordPress theme versions 1.5.0 and earlier allows remote unauthenticated attackers to read arbitrary files from the underlying server. The flaw is rooted in PHP file-inclusion handling (CWE-98) and has no public exploit identified at time of analysis, but its unauthenticated network reachability makes it a notable risk for sites still running the affected ThemeREX product.
Unauthenticated local file inclusion in the ThemeREX Tipsy WordPress theme versions 1.1 and earlier allows remote attackers to coerce the PHP interpreter into including arbitrary files via attacker-controlled path parameters. Successful exploitation can disclose sensitive server-side files, leak configuration secrets such as wp-config.php database credentials, and - depending on environment - escalate to code execution by including log files, session files, or other writable artifacts. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.
Unauthenticated Local File Inclusion in the ThemeREX Resurs WordPress theme versions 1.3 and below allows remote attackers to include and execute arbitrary local files on the server. The flaw, tracked under CWE-98 (Improper Control of Filename for Include/Require), enables disclosure of sensitive files and potential code execution depending on server configuration. No public exploit identified at time of analysis, though Patchstack has confirmed the issue against the affected theme.
Unauthenticated Local File Inclusion in the ThemeREX Orpheus WordPress theme (versions <= 1.3) allows remote attackers to read arbitrary files on the server and potentially achieve code execution via PHP file inclusion. The flaw stems from improper control of filenames in an include/require statement (CWE-98), and while no public exploit has been identified at time of analysis, the CVSS 8.1 rating reflects high impact across confidentiality, integrity, and availability. Risk is somewhat tempered by the high attack complexity metric in the CVSS vector.
Unauthenticated local file inclusion in the Snowy WordPress theme (ThemeREX) versions up to and including 1.13 allows remote attackers to coerce the PHP runtime into including arbitrary files from the server filesystem. The flaw is tracked as CWE-98 (Improper Control of Filename for Include/Require), reported by Patchstack, and carries a CVSS 3.1 score of 8.1 (High) reflecting high-complexity but unauthenticated network exploitation. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Unauthenticated local file inclusion in the ThemeREX Quirky WordPress theme versions 1.23 and earlier allows remote attackers to include and disclose arbitrary local files on the server. The flaw stems from improper control of filename for include/require statements (CWE-98), which can escalate to remote code execution if attackers can plant or reach an includable PHP payload. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated local file inclusion in the Gat WordPress theme (versions 1.16 and earlier) allows remote attackers to include arbitrary local files on the server, potentially leading to disclosure of sensitive configuration data, credentials, or remote code execution if combined with uploadable content. No public exploit identified at time of analysis, but the CVSS 8.1 rating reflects high confidentiality, integrity, and availability impact. The vulnerability is reported by Patchstack and affects the ThemeRex Gat theme.
Unauthenticated local file inclusion in the ThemeREX Ingenioso WordPress theme through version 1.14.0 allows remote attackers to coerce the PHP application into including arbitrary server-side files, leading to disclosure of sensitive content and potential remote code execution where uploaded or log-poisoned files can be reached. The flaw is classified under CWE-98 (improper control of filename for include/require) and was disclosed via Patchstack with no public exploit identified at time of analysis. CVSS is rated 8.1 (High) with high attack complexity, reflecting that successful exploitation depends on identifying a reachable include path.
Unauthenticated local file inclusion in the AirSupply WordPress theme versions up to and including 2.0.0 allows remote attackers to coerce the PHP application into including arbitrary local files, exposing sensitive data and potentially leading to code execution. Reported by Patchstack and tracked under CWE-98 (improper PHP file inclusion), with no public exploit identified at time of analysis and no EPSS or KEV signal supplied in the input. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N) indicates network-reachable, unauthenticated exploitation that nevertheless requires meeting non-trivial conditions to succeed.
Unauthenticated PHP object injection in the ThemeREX Addons WordPress plugin (versions 2.36.1.1 and earlier) allows remote attackers to inject crafted serialized objects that are deserialized by the plugin, potentially leading to remote code execution, arbitrary file operations, or full site compromise when a suitable PHP gadget chain is present. The flaw is reachable without authentication and scores CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the CVE is not currently listed in CISA KEV.
Unauthenticated local file inclusion in the ThemeRex HomeRoofer WordPress theme through version 2.11.0 allows remote attackers to include and read arbitrary local files on the server, potentially leading to source code disclosure, credential theft from wp-config.php, and in some PHP configurations remote code execution. The flaw is reachable without authentication over HTTP, and no public exploit has been identified at time of analysis though Patchstack has catalogued the issue in their WordPress vulnerability database. No CISA KEV listing or EPSS data was supplied in the source intelligence.
Unauthenticated Local File Inclusion affects the Joly WordPress theme by ThemeREX in versions up to and including 1.22.0, allowing remote attackers without credentials to coerce the PHP application into including arbitrary local files. Successful exploitation can disclose sensitive configuration (such as wp-config.php containing database credentials and auth keys) and, depending on server configuration, escalate to remote code execution via log poisoning or session file inclusion. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthenticated local file inclusion in the ThemeREX Neuronet WordPress theme before version 1.14.0 allows remote attackers to coerce the PHP runtime into including arbitrary files via untrusted input reaching an include/require statement. The flaw is reachable without authentication or user interaction, but CVSS marks attack complexity as High, suggesting non-trivial preconditions for full exploitation. No public exploit identified at time of analysis, and the issue is not on the CISA KEV list.
Local File Inclusion in the ThemeREX ITactics WordPress theme versions 1.0 and earlier allows remote unauthenticated attackers to include arbitrary files from the underlying server, leading to disclosure of sensitive configuration data and potentially PHP code execution if attacker-controlled content can be staged on the host. Tracked by Patchstack and indexed in ENISA EUVD as EUVD-2025-210182, the issue carries a CVSS 8.1 (High) score with no public exploit identified at time of analysis.