Theme-Rex vulnerabilities and threats

236 threats

Severity	CVSS	Signals	Threat	Source	Published
High	8.1	EPSS 0.5%	CVE-2026-27990ConFix (WordPress plugin) · Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File High8.1EPSS 0.5%2026-03-05CVE Database V5CVE-2026-27990 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX ConFix confix allows PHP Local File Inclusion.This issue affects ConFix: from n/a through <= 1.013. EPSS 0.5%Vulnerability ThemeREX	CVE Database V5	2026-03-05
High	8.1	EPSS 0.5%	CVE-2026-27989Quanzo (WordPress plugin) · Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File High8.1EPSS 0.5%2026-03-05CVE Database V5CVE-2026-27989 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Quanzo quanzo allows PHP Local File Inclusion.This issue affects Quanzo: from n/a through <= 1.0.10. EPSS 0.5%Vulnerability ThemeREX	CVE Database V5	2026-03-05
High	8.1	EPSS 0.5%	CVE-2026-27988Equadio (WordPress plugin) · Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File High8.1EPSS 0.5%2026-03-05CVE Database V5CVE-2026-27988 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Equadio equadio allows PHP Local File Inclusion.This issue affects Equadio: from n/a through <= 1.1.3. EPSS 0.5%Vulnerability ThemeREX	CVE Database V5	2026-03-05
High	8.1	EPSS 0.5%	CVE-2026-27987The Qlean (WordPress plugin) · Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File High8.1EPSS 0.5%2026-03-05CVE Database V5CVE-2026-27987 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX The Qlean the-qlean allows PHP Local File Inclusion.This issue affects The Qlean: from n/a through <= 2.12. EPSS 0.5%Vulnerability ThemeREX	CVE Database V5	2026-03-05
High	8.1	EPSS 0.5%	CVE-2026-27986OsTende (WordPress plugin) · Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File High8.1EPSS 0.5%2026-03-05CVE Database V5CVE-2026-27986 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX OsTende ostende allows PHP Local File Inclusion.This issue affects OsTende: from n/a through <= 1.4.3. EPSS 0.5%Vulnerability ThemeREX	CVE Database V5	2026-03-05
High	8.1	EPSS 0.5%	CVE-2026-27985Humanum (WordPress plugin) · Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File High8.1EPSS 0.5%2026-03-05CVE Database V5CVE-2026-27985 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Humanum humanum allows PHP Local File Inclusion.This issue affects Humanum: from n/a through <= 1.1.4. EPSS 0.5%Vulnerability ThemeREX	CVE Database V5	2026-03-05
Critical	9.8	EPSS 0.4%	CVE-2026-27439Dentario (WordPress plugin) · Deserialization of Untrusted Data Critical9.8EPSS 0.4%2026-03-05CVE Database V5CVE-2026-27439 Deserialization of Untrusted Data vulnerability in ThemeREX Dentario dentario allows Object Injection.This issue affects Dentario: from n/a through <= 1.5. EPSS 0.4%Vulnerability ThemeREX	CVE Database V5	2026-03-05
Critical	9.8	EPSS 0.4%	CVE-2026-27438Kingler (WordPress plugin) · Deserialization of Untrusted Data Critical9.8EPSS 0.4%2026-03-05CVE Database V5CVE-2026-27438 Deserialization of Untrusted Data vulnerability in ThemeREX Kingler kingler allows Object Injection.This issue affects Kingler: from n/a through <= 1.7. EPSS 0.4%Vulnerability ThemeREX	CVE Database V5	2026-03-05
Critical	9.8	EPSS 0.4%	CVE-2026-27437Tennis Club (WordPress plugin) · Deserialization of Untrusted Data Critical9.8EPSS 0.4%2026-03-05CVE Database V5CVE-2026-27437 Deserialization of Untrusted Data vulnerability in ThemeREX Tennis Club tennis-sportclub allows Object Injection.This issue affects Tennis Club: from n/a through <= 1.2.3. EPSS 0.4%Vulnerability ThemeREX	CVE Database V5	2026-03-05
Critical	9.8	EPSS 0.5%	CVE-2026-22474Equestrian Centre (WordPress plugin) · Deserialization of Untrusted Data Critical9.8EPSS 0.5%2026-03-05CVE Database V5CVE-2026-22474 Deserialization of Untrusted Data vulnerability in ThemeREX Equestrian Centre equestrian-centre allows Object Injection.This issue affects Equestrian Centre: from n/a through <= 1.5. EPSS 0.5%Vulnerability ThemeREX	CVE Database V5	2026-03-05
Critical	9.8	EPSS 0.6%	CVE-2026-22454Solaris (WordPress plugin) · Deserialization of Untrusted Data Critical9.8EPSS 0.6%2026-03-05CVE Database V5CVE-2026-22454 Deserialization of Untrusted Data vulnerability in ThemeREX Solaris solaris allows Object Injection.This issue affects Solaris: from n/a through <= 2.5. EPSS 0.6%Vulnerability ThemeREX	CVE Database V5	2026-03-05
Critical	9.8	EPSS 0.6%	CVE-2026-22453Pets Club (WordPress plugin) · Deserialization of Untrusted Data Critical9.8EPSS 0.6%2026-03-05CVE Database V5CVE-2026-22453 Deserialization of Untrusted Data vulnerability in ThemeREX Pets Club petclub allows Object Injection.This issue affects Pets Club: from n/a through <= 2.3. EPSS 0.6%Vulnerability ThemeREX	CVE Database V5	2026-03-05
High	8.1	EPSS 0.6%	CVE-2026-22452Hoverex (WordPress plugin) · Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File High8.1EPSS 0.6%2026-03-05CVE Database V5CVE-2026-22452 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Hoverex hoverex allows PHP Local File Inclusion.This issue affects Hoverex: from n/a through <= 1.5.10. EPSS 0.6%Vulnerability ThemeREX	CVE Database V5	2026-03-05
High	8.1	EPSS 0.6%	CVE-2026-22443Alliance (WordPress plugin) · Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File High8.1EPSS 0.6%2026-03-05CVE Database V5CVE-2026-22443 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Alliance alliance allows PHP Local File Inclusion.This issue affects Alliance: from n/a through <= 3.1.1. EPSS 0.6%Vulnerability ThemeREX	CVE Database V5	2026-03-05
Critical	9.8	EPSS 0.6%	CVE-2025-54001Classter (WordPress plugin) · Deserialization of Untrusted Data Critical9.8EPSS 0.6%2026-03-05CVE Database V5CVE-2025-54001 Deserialization of Untrusted Data vulnerability in ThemeREX Classter classter allows Object Injection.This issue affects Classter: from n/a through <= 2.5. EPSS 0.6%Vulnerability ThemeREX	CVE Database V5	2026-03-05
High	8.1	EPSS 0.6%	CVE-2025-53335Berger (WordPress plugin) · Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File High8.1EPSS 0.6%2026-03-05CVE Database V5CVE-2025-53335 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Berger berger allows PHP Local File Inclusion.This issue affects Berger: from n/a through <= 1.1.1. EPSS 0.6%Vulnerability ThemeREX	CVE Database V5	2026-03-05
High	8.1	EPSS 0.6%	CVE-2025-69406FreightCo (WordPress plugin) · Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File High8.1EPSS 0.6%2026-02-20CVE Database V5CVE-2025-69406 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX FreightCo freightco allows PHP Local File Inclusion.This issue affects FreightCo: from n/a through <= 1.1.7. EPSS 0.6%Vulnerability ThemeREX	CVE Database V5	2026-02-20
Critical	9.8	EPSS 0.4%	CVE-2025-69405Lorem Ipsum \| Books & Media Store (WordPress plugin) · Deserialization of Untrusted Data Critical9.8EPSS 0.4%2026-02-20CVE Database V5CVE-2025-69405 Deserialization of Untrusted Data vulnerability in ThemeREX Lorem Ipsum \| Books & Media Store lorem-ipsum-books-media-store allows Object Injection.This issue affects Lorem Ipsum \| Books & Media Store: from n/a through <= 1.2.11. EPSS 0.4%Vulnerability ThemeREX	CVE Database V5	2026-02-20
Critical	9.8	EPSS 0.4%	CVE-2025-69404Extreme Store (WordPress plugin) · Deserialization of Untrusted Data Critical9.8EPSS 0.4%2026-02-20CVE Database V5CVE-2025-69404 Deserialization of Untrusted Data vulnerability in ThemeREX Extreme Store extremestore allows Object Injection.This issue affects Extreme Store: from n/a through <= 1.5.10. EPSS 0.4%Vulnerability ThemeREX	CVE Database V5	2026-02-20
High	8.1	EPSS 0.6%	CVE-2025-69402R&F (WordPress plugin) · Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File High8.1EPSS 0.6%2026-02-20CVE Database V5CVE-2025-69402 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX R&F rf allows PHP Local File Inclusion.This issue affects R&F: from n/a through <= 1.5. EPSS 0.6%Vulnerability ThemeREX	CVE Database V5	2026-02-20

Page 11 of 12