Theme-Rex vulnerabilities and threats

CVE-2026-62074 is a high severity vulnerability in ThemeREX Ozeum versions up to and including 1.3.0. It involves an unauthenticated Local File Inclusion (LFI) flaw due to improper control of filenames in include/require statements in PHP. This vulnerability can lead to remote file inclusion attacks, potentially allowing attackers to execute arbitrary code or access sensitive information.

CVE-2026-62054 is a critical vulnerability in ThemeREX Yacht Rental versions up to 2.6 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-62053 is a critical vulnerability in ThemeREX Wine House versions up to 3.20 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.

CVE-2026-62052 is a critical vulnerability in ThemeREX Tipsy versions 1.6 and earlier that allows unauthenticated PHP object injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.

CVE-2026-62051 is a critical vulnerability in ThemeREX Stargaze versions up to 1.10 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.

CVE-2026-62050 is a critical vulnerability in ThemeREX Splendour versions up to 1.23 that allows unauthenticated PHP object injection due to deserialization of untrusted data. This flaw can lead to full compromise of confidentiality, integrity, and availability of the affected system.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Education Center education allows Reflected XSS.This issue affects Education Center: from n/a through 3.6.12.

Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.

Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.

Unauthenticated PHP Object Injection in ThemeREX Addons < 2.45.0 versions.

CVE-2026-66650 is a critical vulnerability in Theme-Rex FreightCo versions up to and including 1.1.15. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data (CWE-502). This flaw allows an attacker to execute arbitrary code remotely without any authentication.

CVE-2026-65573 is a critical vulnerability in ThemeREX Abelle versions up to and including 1.22. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data (CWE-502). This flaw allows an attacker to execute arbitrary code remotely without any authentication.

Unauthenticated Cross Site Request Forgery (CSRF) in Booked <= 3.0.0 versions.

Subscriber Broken Access Control in Booked <= 3.0.0 versions.

CVE-2025-69175 is a high severity vulnerability affecting ThemeREX Line Agency versions up to and including 1.3.1. It is an unauthenticated Local File Inclusion (LFI) issue caused by improper control of filenames used in include/require statements in PHP, classified under CWE-98. This vulnerability allows an attacker to include local files on the server without authentication, potentially leading to full compromise of confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor. The vulnerability has not been reported as exploited in the wild.

CVE-2025-69174 is a high severity vulnerability in ThemeREX Etude versions up to and including 1.6. It allows unauthenticated local file inclusion due to improper control of filenames used in include/require statements in PHP. This can lead to remote file inclusion attacks. The vulnerability is identified as CWE-98. No official patch or remediation guidance is currently available.

CVE-2025-69170 is a high-severity vulnerability in ThemeREX Eventicity versions up to and including 1.5. It involves an unauthenticated local file inclusion (LFI) issue due to improper control of filenames in include/require statements. This flaw allows an attacker to potentially include and execute arbitrary local files on the server, leading to full compromise of confidentiality, integrity, and availability.

CVE-2025-69166 is a high-severity vulnerability in ThemeREX Gunslinger versions up to and including 1.7. It involves an unauthenticated local file inclusion (LFI) issue due to improper control of filenames in include/require statements in PHP, classified under CWE-98. This flaw allows an attacker to potentially include arbitrary files on the server, leading to full compromise of confidentiality, integrity, and availability.

CVE-2025-69164 is a high-severity vulnerability in ThemeREX Skyward versions up to and including 1.10. It allows unauthenticated attackers to perform Local File Inclusion due to improper control of filenames in include/require statements in PHP. This can lead to full confidentiality, integrity, and availability compromise of the affected system.

CVE-2025-69158 is a high-severity vulnerability in ThemeREX Granola versions up to and including 1.13. It involves an unauthenticated local file inclusion issue due to improper control of filenames in include/require statements in PHP, classified under CWE-98. This vulnerability allows an attacker to potentially execute arbitrary code by including local files without authentication.