75
CVEs
12
Critical
60
High
0
KEV
1
PoC
70
Unpatched C/H
2.7%
Patch Rate
0.5%
Avg EPSS
Severity Breakdown
CRITICAL
12
HIGH
60
MEDIUM
3
LOW
0
Monthly CVE Trend
Affected Products (30)
PHP
67
Wordpress Theme
65
Wordpress Plugin
4
Addons
3
Puzzles
3
Booked
2
Abelle
2
Themerex Addons
2
Modernee
1
Wellspring Water Filter Systems
1
Buisson
1
Prolingua
1
Wineshop
1
Choreo
1
Nelson
1
Ozeum Museum
1
Gunslinger
1
Kelly Young
1
Piqes Creative Startup Agency Wordpress Theme
1
Savejulia Personal Fundraising Campaign
1
Tediss Soft Play Area Cafe Child Care Center
1
Resurs
1
Pixefy
1
Gridiron
1
Bugster Pests Control
1
Nexio
1
Skydiving And Flying Company
1
Kratz Digital Agency
1
Copypress
1
Nazareth Church
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2020-10257 | The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 8.9% | 69 |
PoC
No patch
|
| CVE-2026-65573 | Insecure deserialization in the Abelle WordPress theme (ThemeREX) versions 1.22 and earlier lets unauthenticated remote attackers inject crafted PHP objects that the application deserializes, enabling PHP Object Injection. Because attacker-supplied serialized data reaches unsafe unserialize() logic without authentication, an adversary can potentially achieve remote code execution, data tampering, or full site compromise depending on available gadget chains in WordPress core, the theme, or co-installed plugins. There is no public exploit identified at time of analysis, but the flaw carries a CVSS 9.8 rating reflecting network-reachable, unauthenticated, high-impact exploitation. | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|
| CVE-2026-27082 | A PHP Object Injection vulnerability exists in ThemeREX Love Story WordPress theme through version 1.3.12, stemming from unsafe deserialization of untrusted data. This vulnerability allows attackers to inject malicious serialized objects that can lead to remote code execution or other object-oriented attack chains. The vulnerability is classified as CWE-502 (Deserialization of Untrusted Data) and has been reported by Patchstack; no CVSS score or EPSS data is currently available, and KEV status is unknown. | CRITICAL | 9.8 | 0.0% | 49 |
No patch
|
| CVE-2026-27083 | A PHP Object Injection vulnerability exists in the ThemeREX Work & Travel Company WordPress theme through version 1.2, stemming from unsafe deserialization of untrusted data (CWE-502). An attacker can exploit this vulnerability to inject malicious objects into the application, potentially leading to remote code execution or arbitrary object manipulation depending on the gadget chains available in the WordPress environment. No CVSS score, EPSS data, or KEV status is currently available, and the vulnerability was identified and reported by Patchstack, though active exploitation status remains unclear. | CRITICAL | 9.8 | 0.0% | 49 |
No patch
|
| CVE-2026-27084 | A PHP Object Injection vulnerability exists in the ThemeREX Buisson WordPress theme through version 1.1.11, stemming from unsafe deserialization of untrusted data (CWE-502). This flaw allows attackers to inject malicious serialized objects that can lead to arbitrary code execution or other object manipulation attacks depending on available gadget chains in the WordPress environment. While no CVSS score or EPSS data is currently published and the vulnerability has not been listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, the public disclosure via Patchstack indicates active awareness in the security community. | CRITICAL | 9.8 | 0.0% | 49 |
No patch
|
| CVE-2025-69108 | Unauthenticated PHP Object Injection in the ThemeREX Hot Coffee WordPress theme (versions ≤ 1.7) allows remote attackers to inject arbitrary serialized PHP objects, potentially triggering property-oriented programming (POP) chains that lead to remote code execution, arbitrary file operations, or full site compromise. The flaw was disclosed by Patchstack and carries a CVSS 9.8 due to network reachability with no authentication or user interaction, though no public exploit has been identified at time of analysis. | CRITICAL | 9.8 | 0.5% | 49 |
No patch
|
| CVE-2025-69122 | Unauthenticated PHP Object Injection in the ThemeREX SeaFood Company WordPress theme (versions ≤1.4) enables remote attackers to deliver crafted serialized payloads that trigger insecure deserialization within PHP, potentially leading to remote code execution, file manipulation, or full site compromise depending on available gadget chains in the host WordPress stack. Reported by Patchstack and tracked as EUVD-2025-210200, with no public exploit identified at time of analysis. | CRITICAL | 9.8 | 0.6% | 49 |
No patch
|
| CVE-2025-60205 | Unauthenticated PHP object injection in the ThemeREX Addons WordPress plugin (versions 2.36.1.1 and earlier) allows remote attackers to inject crafted serialized objects that are deserialized by the plugin, potentially leading to remote code execution, arbitrary file operations, or full site compromise when a suitable PHP gadget chain is present. The flaw is reachable without authentication and scores CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the CVE is not currently listed in CISA KEV. | CRITICAL | 9.8 | 0.5% | 49 |
No patch
|
| CVE-2025-69111 | Unauthenticated PHP object injection in the ThemeREX Reisen WordPress theme versions 1.4.1 and earlier allows remote attackers to trigger deserialization of attacker-controlled data without authentication. Successful exploitation can lead to full site compromise via gadget chains commonly available in WordPress core or active plugins, with CVSS rated 9.8 critical. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV. | CRITICAL | 9.8 | 0.4% | 49 |
No patch
|
| CVE-2025-69127 | Unauthenticated PHP Object Injection in the ThemeREX Plumbing WordPress theme versions 1.6 and earlier allows remote attackers to inject arbitrary PHP objects via untrusted deserialization, potentially leading to full site compromise when a suitable POP gadget chain is present. No public exploit identified at time of analysis, but the CVSS 9.8 rating and unauthenticated network attack vector make this a high-priority issue for any WordPress site running this theme. | CRITICAL | 9.8 | 0.4% | 49 |
No patch
|
| CVE-2026-62105 | Unauthenticated PHP Object Injection in the ThemeREX Addons (trx_addons) WordPress plugin before 2.45.0 lets remote attackers inject arbitrary serialized PHP objects into the application. Because no authentication is required (CVSS 9.8, PR:N/UI:N), an attacker can supply crafted serialized data to a vulnerable entry point; when combined with a suitable POP gadget chain present in the plugin, another plugin, a theme, or WordPress core, this can escalate to code execution, arbitrary file operations, or data compromise. Reported by Patchstack; no public exploit identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.8 | 0.3% | 49 |
|
| CVE-2024-13770 | The Puzzles | WP Magazine / Review with Store WordPress Theme + RTL theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.2.4 via deserialization of. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available. | HIGH | 8.1 | 0.5% | 41 |
No patch
|
| CVE-2026-22324 | A PHP Local File Inclusion vulnerability exists in the ThemeREX Melania WordPress theme, allowing remote attackers to include and execute arbitrary local files on the server. All versions up to and including 2.5.0 are affected. The CVSS score of 8.1 indicates high severity with network-based attack vector, though attack complexity is rated as high; there is no evidence of active exploitation (not in KEV) or public proof-of-concept at this time. | HIGH | 8.1 | 0.1% | 41 |
No patch
|
| CVE-2026-22494 | A Local File Inclusion (LFI) vulnerability exists in the ThemeREX Good Homes WordPress theme through version 1.3.13, allowing attackers to include and execute arbitrary local files on the affected server. The vulnerability stems from improper control of filenames in PHP include/require statements (CWE-98), enabling unauthenticated attackers to disclose sensitive information or achieve remote code execution by accessing system files. No CVSS score, EPSS data, or active KEV designation was reported, but the LFI classification and information disclosure impact indicate this requires prompt patching. | HIGH | 8.1 | 0.1% | 41 |
No patch
|
| CVE-2026-22503 | A Local File Inclusion (LFI) vulnerability exists in the ThemeREX Nelson WordPress theme through version 1.2.0, allowing attackers to read arbitrary files from the affected server. The vulnerability stems from improper control of filenames in PHP include/require statements (CWE-98), enabling information disclosure attacks without authentication. While no CVSS score or EPSS data is currently available, the LFI classification and public disclosure via Patchstack indicate this is a genuine security concern affecting WordPress installations using vulnerable Nelson theme versions. | HIGH | 8.1 | 0.1% | 41 |
No patch
|