Theme-Rex vulnerabilities and threats

236 threats

Severity	CVSS	Signals	Threat	Source	Published
High	8.1	EPSS 0.4%	CVE-2025-69121Deliciosa (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.4%2026-06-16CVE Database V5CVE-2025-69121 Unauthenticated Local File Inclusion in Deliciosa <= 1.10.0 versions. EPSS 0.4%Vulnerability ThemeREX CWE-98	CVE Database V5	2026-06-16
High	8.1	EPSS 0.4%	CVE-2025-69119Corbesier (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.4%2026-06-16CVE Database V5CVE-2025-69119 Unauthenticated Local File Inclusion in Corbesier <= 1.15.0 versions. EPSS 0.4%Vulnerability ThemeREX CWE-98	CVE Database V5	2026-06-16
High	8.1	EPSS 0.3%	CVE-2025-69118CopyPress (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.3%2026-06-16CVE Database V5CVE-2025-69118 Unauthenticated Local File Inclusion in CopyPress <= 1.4.5 versions. EPSS 0.3%Vulnerability ThemeREX CWE-98	CVE Database V5	2026-06-16
High	8.1	EPSS 0.4%	CVE-2025-69116Iona (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.4%2026-06-16CVE Database V5CVE-2025-69116 Unauthenticated Local File Inclusion in Iona <= 1.0.8 versions. EPSS 0.4%Vulnerability ThemeREX CWE-98	CVE Database V5	2026-06-16
High	8.1	EPSS 0.4%	CVE-2025-69114MaxiNet (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.4%2026-06-16CVE Database V5CVE-2025-69114 Unauthenticated Local File Inclusion in MaxiNet <= 1.2.10 versions. EPSS 0.4%Vulnerability ThemeREX CWE-98	CVE Database V5	2026-06-16
High	8.1	EPSS 0.4%	CVE-2025-69113Nexio (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.4%2026-06-16CVE Database V5CVE-2025-69113 Unauthenticated Local File Inclusion in Nexio <= 1.10.0 versions. EPSS 0.4%Vulnerability ThemeREX CWE-98	CVE Database V5	2026-06-16
High	8.1	EPSS 0.4%	CVE-2025-69112Planty (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.4%2026-06-16CVE Database V5CVE-2025-69112 Unauthenticated Local File Inclusion in Planty <= 1.14.0 versions. EPSS 0.4%Vulnerability ThemeREX CWE-98	CVE Database V5	2026-06-16
High	8.1	EPSS 0.4%	CVE-2025-69109Raider Spirit (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.4%2026-06-16CVE Database V5CVE-2025-69109 Unauthenticated Local File Inclusion in Raider Spirit <= 1.1.2 versions. EPSS 0.4%Vulnerability ThemeREX CWE-98	CVE Database V5	2026-06-16
Critical	9.8	EPSS 0.5%	CVE-2025-69108Hot Coffee (WordPress plugin) · Deserialization of Untrusted Data Critical9.8EPSS 0.5%2026-06-16CVE Database V5CVE-2025-69108 Unauthenticated PHP Object Injection in Hot Coffee <= 1.7 versions. EPSS 0.5%Vulnerability ThemeREX CWE-502	CVE Database V5	2026-06-16
High	8.1	EPSS 0.4%	CVE-2025-69107Rosaleen (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.4%2026-06-16CVE Database V5CVE-2025-69107 Unauthenticated Local File Inclusion in Rosaleen <= 2.8 versions. EPSS 0.4%Vulnerability ThemeREX CWE-98	CVE Database V5	2026-06-16
High	8.1	EPSS 0.4%	CVE-2025-69105Modernee (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.4%2026-06-16CVE Database V5CVE-2025-69105 Unauthenticated Local File Inclusion in Modernee <= 1.6.0 versions. EPSS 0.4%Vulnerability ThemeREX CWE-98	CVE Database V5	2026-06-16
Critical	9.8	EPSS 0.5%	CVE-2026-27084Buisson (WordPress plugin) · Deserialization of Untrusted Data Critical9.8EPSS 0.5%2026-03-25CVE Database V5CVE-2026-27084 Deserialization of Untrusted Data vulnerability in ThemeREX Buisson buisson allows Object Injection.This issue affects Buisson: from n/a through <= 1.1.11. EPSS 0.5%Vulnerability ThemeREX	CVE Database V5	2026-03-25
Critical	9.8	EPSS 0.4%	CVE-2026-27083Work & Travel Company (WordPress plugin) · Deserialization of Untrusted Data Critical9.8EPSS 0.4%2026-03-25CVE Database V5CVE-2026-27083 Deserialization of Untrusted Data vulnerability in ThemeREX Work & Travel Company work-travel-company allows Object Injection.This issue affects Work & Travel Company: from n/a through <= 1.2. EPSS 0.4%Vulnerability ThemeREX	CVE Database V5	2026-03-25
Critical	9.8	EPSS 0.4%	CVE-2026-27082Love Story (WordPress plugin) · Deserialization of Untrusted Data Critical9.8EPSS 0.4%2026-03-25CVE Database V5CVE-2026-27082 Deserialization of Untrusted Data vulnerability in ThemeREX Love Story lovestory allows Object Injection.This issue affects Love Story: from n/a through <= 1.3.12. EPSS 0.4%Vulnerability ThemeREX	CVE Database V5	2026-03-25
High	8.1	EPSS 0.5%	CVE-2026-22504ProLingua (WordPress plugin) · Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File High8.1EPSS 0.5%2026-03-25CVE Database V5CVE-2026-22504 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX ProLingua prolingua allows PHP Local File Inclusion.This issue affects ProLingua: from n/a through <= 1.1.12. EPSS 0.5%Vulnerability ThemeREX	CVE Database V5	2026-03-25
High	8.1	EPSS 0.5%	CVE-2026-22503Nelson (WordPress plugin) · Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File High8.1EPSS 0.5%2026-03-25CVE Database V5CVE-2026-22503 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Nelson nelson allows PHP Local File Inclusion.This issue affects Nelson: from n/a through <= 1.2.0. EPSS 0.5%Vulnerability ThemeREX	CVE Database V5	2026-03-25
High	8.1	EPSS 0.5%	CVE-2026-22494Good Homes (WordPress plugin) · Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File High8.1EPSS 0.5%2026-03-25CVE Database V5CVE-2026-22494 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Good Homes good-homes allows PHP Local File Inclusion.This issue affects Good Homes: from n/a through <= 1.3.13. EPSS 0.5%Vulnerability ThemeREX	CVE Database V5	2026-03-25
High	8.1	EPSS 0.5%	CVE-2026-22324Melania (WordPress plugin) · PHP Remote File Inclusion High8.1EPSS 0.5%2026-03-20CVE Database V5CVE-2026-22324 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Melania allows PHP Local File Inclusion.This issue affects Melania: from n/a through 2.5.0. EPSS 0.5%Vulnerability ThemeREX CWE-98	CVE Database V5	2026-03-20
High	8.1	EPSS 0.4%	CVE-2026-28128Verse (WordPress plugin) · Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File High8.1EPSS 0.4%2026-03-05CVE Database V5CVE-2026-28128 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Verse verse allows PHP Local File Inclusion.This issue affects Verse: from n/a through <= 1.7.0. EPSS 0.4%Vulnerability ThemeREX	CVE Database V5	2026-03-05
High	8.1	EPSS 0.4%	CVE-2026-28120Dr.Patterson (WordPress plugin) · Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File High8.1EPSS 0.4%2026-03-05CVE Database V5CVE-2026-28120 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Dr.Patterson dr-patterson allows PHP Local File Inclusion.This issue affects Dr.Patterson: from n/a through <= 1.3.2. EPSS 0.4%Vulnerability ThemeREX	CVE Database V5	2026-03-05

Page 6 of 12