Theme-Rex vulnerabilities and threats

236 threats

Severity	CVSS	Signals	Threat	Source	Published
High	8.1	EPSS 0.4%	CVE-2025-58953Joly (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.4%2026-06-17CVE Database V5CVE-2025-58953 CVE-2025-58953 is a high-severity vulnerability in ThemeREX Joly versions up to and including 1.22.0. It allows unauthenticated local file inclusion due to improper control of filenames in include/require statements. This can lead to remote file inclusion attacks. The vulnerability has a CVSS score of 8.1, indicating a significant risk to confidentiality, integrity, and availability. EPSS 0.4%Vulnerability ThemeREX CWE-98	CVE Database V5	2026-06-17
High	8.1	EPSS 0.3%	CVE-2025-58952Neuronet (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.3%2026-06-17CVE Database V5CVE-2025-58952 Unauthenticated Local File Inclusion in Neuronet < 1.14.0 versions. EPSS 0.3%Vulnerability ThemeREX CWE-98	CVE Database V5	2026-06-17
High	8.1	EPSS 0.3%	CVE-2025-69176ITactics (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.3%2026-06-16CVE Database V5CVE-2025-69176 Unauthenticated Local File Inclusion in ITactics <= 1.0 versions. EPSS 0.3%Vulnerability ThemeREX CWE-98	CVE Database V5	2026-06-16
High	8.1	EPSS 0.4%	CVE-2025-69168Spike (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.4%2026-06-16CVE Database V5CVE-2025-69168 Unauthenticated Local File Inclusion in Spike <= 1.2 versions. EPSS 0.4%Vulnerability ThemeREX CWE-98	CVE Database V5	2026-06-16
High	8.1	EPSS 0.4%	CVE-2025-69167Eros (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.4%2026-06-16CVE Database V5CVE-2025-69167 Unauthenticated Local File Inclusion in Eros <= 1.3 versions. EPSS 0.4%Vulnerability ThemeREX CWE-98	CVE Database V5	2026-06-16
High	8.1	EPSS 0.4%	CVE-2025-69165Choreo (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.4%2026-06-16CVE Database V5CVE-2025-69165 Unauthenticated Local File Inclusion in Choreo <= 1.6 versions. EPSS 0.4%Vulnerability ThemeREX CWE-98	CVE Database V5	2026-06-16
High	8.1	EPSS 0.4%	CVE-2025-69163WineShop (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.4%2026-06-16CVE Database V5CVE-2025-69163 Unauthenticated Local File Inclusion in WineShop <= 3.17 versions. EPSS 0.4%Vulnerability ThemeREX CWE-98	CVE Database V5	2026-06-16
High	8.1	EPSS 0.4%	CVE-2025-69162Grecko (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.4%2026-06-16CVE Database V5CVE-2025-69162 Unauthenticated Local File Inclusion in Grecko <= 5.17 versions. EPSS 0.4%Vulnerability ThemeREX CWE-98	CVE Database V5	2026-06-16
High	8.1	EPSS 0.4%	CVE-2025-69160Gita (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.4%2026-06-16CVE Database V5CVE-2025-69160 Unauthenticated Local File Inclusion in Gita <= 1.11 versions. EPSS 0.4%Vulnerability ThemeREX CWE-98	CVE Database V5	2026-06-16
High	8.1	EPSS 0.4%	CVE-2025-69159Printo (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.4%2026-06-16CVE Database V5CVE-2025-69159 Unauthenticated Local File Inclusion in Printo <= 1.11 versions. EPSS 0.4%Vulnerability ThemeREX CWE-98	CVE Database V5	2026-06-16
High	8.1	EPSS 0.4%	CVE-2025-69150Medeus (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.4%2026-06-16CVE Database V5CVE-2025-69150 Unauthenticated Local File Inclusion in Medeus <= 1.14 versions. EPSS 0.4%Vulnerability ThemeREX CWE-98	CVE Database V5	2026-06-16
High	8.1	EPSS 0.4%	CVE-2025-69149Top Dog (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.4%2026-06-16CVE Database V5CVE-2025-69149 Unauthenticated Local File Inclusion in Top Dog <= 1.0.5 versions. EPSS 0.4%Vulnerability ThemeREX CWE-98	CVE Database V5	2026-06-16
High	8.1	EPSS 0.4%	CVE-2025-69147Putter (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.4%2026-06-16CVE Database V5CVE-2025-69147 Unauthenticated Local File Inclusion in Putter <= 1.17 versions. EPSS 0.4%Vulnerability ThemeREX CWE-98	CVE Database V5	2026-06-16
High	8.1	EPSS 0.3%	CVE-2025-69146Dom (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.3%2026-06-16CVE Database V5CVE-2025-69146 Unauthenticated Local File Inclusion in Dom <= 1.24 versions. EPSS 0.3%Vulnerability ThemeREX CWE-98	CVE Database V5	2026-06-16
High	8.1	EPSS 0.4%	CVE-2025-69143Mission (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.4%2026-06-16CVE Database V5CVE-2025-69143 Unauthenticated Local File Inclusion in Mission <= 1.22 versions. EPSS 0.4%Vulnerability ThemeREX CWE-98	CVE Database V5	2026-06-16
High	8.1	EPSS 0.4%	CVE-2025-69142Abelle (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.4%2026-06-16CVE Database V5CVE-2025-69142 Unauthenticated Local File Inclusion in Abelle <= 1.22 versions. EPSS 0.4%Vulnerability ThemeREX CWE-98	CVE Database V5	2026-06-16
High	8.1	EPSS 0.3%	CVE-2025-69141Kelly Young (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.3%2026-06-16CVE Database V5CVE-2025-69141 Unauthenticated Local File Inclusion in Kelly Young <= 1.1.0 versions. EPSS 0.3%Vulnerability ThemeREX CWE-98	CVE Database V5	2026-06-16
High	8.1	EPSS 0.3%	CVE-2025-69125Food Drop (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.3%2026-06-16CVE Database V5CVE-2025-69125 Unauthenticated Local File Inclusion in Food Drop <= 1.3 versions. EPSS 0.3%Vulnerability ThemeREX CWE-98	CVE Database V5	2026-06-16
High	8.1	EPSS 0.4%	CVE-2025-69124Especio (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.4%2026-06-16CVE Database V5CVE-2025-69124 Unauthenticated Local File Inclusion in Especio <= 1.0 versions. EPSS 0.4%Vulnerability ThemeREX CWE-98	CVE Database V5	2026-06-16
Critical	9.8	EPSS 0.5%	CVE-2025-69122SeaFood Company (WordPress plugin) · Deserialization of Untrusted Data Critical9.8EPSS 0.5%2026-06-16CVE Database V5CVE-2025-69122 Unauthenticated PHP Object Injection in SeaFood Company <= 1.4 versions. EPSS 0.5%Vulnerability ThemeREX CWE-502	CVE Database V5	2026-06-16

Page 5 of 12