Theme-Rex vulnerabilities and threats

CVE-2026-54860 is a critical vulnerability in ThemeREX Ozisti versions up to 1.1.10 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.

Unauthenticated PHP Object Injection in Preservation <= 1.15 versions.

CVE-2026-54858 is a critical vulnerability in ThemeREX Printy versions up to 1.13.0 involving unauthenticated PHP object injection due to deserialization of untrusted data. This flaw allows remote attackers to execute arbitrary code without authentication.

CVE-2026-54857 is a critical vulnerability in ThemeREX Quirky versions up to 1.23 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw enables remote attackers to execute arbitrary code without any authentication.

CVE-2026-54856 is a critical vulnerability in ThemeREX RexCoin versions up to 1.2.6 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-112847 is a critical vulnerability in ThemeREX ZenSoul up to version 1.13 that allows deserialization of untrusted data, leading to object injection. This flaw can be exploited remotely without authentication and results in full confidentiality, integrity, and availability compromise.

CVE-2026-81797 is a critical vulnerability in the ThemeRex Buzz Stone | Magazine & Viral Blog WordPress Theme version 1.0.2 and earlier. It involves unauthenticated PHP object injection due to deserialization of untrusted data, which can lead to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-78535 is a critical vulnerability in ThemeRex Photolia versions up to 1.0.3 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.

CVE-2026-78531 is a critical vulnerability in ThemeREX Jacqueline versions up to 2.22 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.

CVE-2026-78529 is a critical vulnerability in ThemeREX Alliance versions up to and including 3.11. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data, classified under CWE-502. The vulnerability allows remote attackers to execute arbitrary code without any authentication.

CVE-2026-66564 is a critical unauthenticated PHP Object Injection vulnerability affecting ThemeREX ShiftCV versions up to and including 3.0.14. This vulnerability involves deserialization of untrusted data, which can lead to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-66563 is a critical vulnerability in ThemeREX Windsor versions up to 2.10 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.

CVE-2026-66483 is a critical vulnerability in ThemeREX Education Center versions up to 3.6.12. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data, allowing an attacker to execute arbitrary code without authentication.

CVE-2026-62125 is a critical vulnerability in ThemeREX Asia Garden versions up to 1.3.1 that allows unauthenticated PHP object injection due to deserialization of untrusted data. This flaw can lead to full compromise of confidentiality, integrity, and availability without requiring user interaction or privileges.

CVE-2026-62124 is a critical vulnerability in ThemeREX's N7 | Golf Club Sports & Events plugin, affecting versions up to 2.21. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data, which can lead to full system compromise. The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability.

CVE-2026-62123 is a critical vulnerability in ThemeREX's Invetex product, affecting versions up to 2.18. It involves unauthenticated PHP object injection due to deserialization of untrusted data, which can lead to full system compromise without requiring user interaction.

CVE-2026-62120 is a critical vulnerability in ThemeREX Law Office versions up to 3.20 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-62090 is a critical vulnerability in ThemeREX WineShop versions up to 3.20 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.

CVE-2026-62087 is a critical vulnerability in ThemeREX Equadio versions up to 1.1.4 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-62086 is a critical vulnerability in ThemeREX Juno versions up to 2.25, involving unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw allows remote attackers to execute arbitrary code without authentication, impacting confidentiality, integrity, and availability.