Theme-Rex vulnerabilities and threats

Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection. This issue affects Royal Event: from n/a through 2.0.

Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.

Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.

CVE-2026-62016 is a critical vulnerability in ThemeREX Gamic versions up to 1.19 that allows unauthenticated PHP object injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.

CVE-2026-62015 is a critical vulnerability in ThemeREX Gamezone versions up to 1.1.11 that allows unauthenticated PHP object injection due to deserialization of untrusted data. This flaw can lead to full system compromise, including complete confidentiality, integrity, and availability loss.

CVE-2026-62014 is a critical vulnerability in ThemeREX EmojiNation versions up to 1.0.12 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.

Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions.

CVE-2026-62012 is a critical vulnerability in ThemeREX Coinpress versions up to 1.0.15 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-62011 is a critical vulnerability in ThemeREX Bonbon versions up to 1.11 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.

CVE-2026-62010 is a critical vulnerability in ThemeREX Avventure versions up to 1.1.12 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full compromise of confidentiality, integrity, and availability of affected systems.

CVE-2026-62009 is a critical vulnerability in ThemeREX Filmax versions up to 1.1.11 that allows unauthenticated PHP object injection due to deserialization of untrusted data. This flaw enables remote attackers to execute arbitrary code without authentication.

Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.

CVE-2026-62006 is a critical vulnerability in ThemeREX Nuts versions up to 1.12 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-62005 is a critical vulnerability in ThemeREX Muzicon versions up to 1.15 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw enables remote attackers to execute arbitrary code without any authentication.

CVE-2026-62004 is a critical vulnerability in ThemeREX Motorix versions 1.11 and earlier. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data, allowing remote attackers to execute arbitrary code without any privileges or user interaction.

CVE-2026-62003 is a critical vulnerability in ThemeREX Mission versions up to 1.22, involving unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw allows remote attackers to execute arbitrary code without authentication.

Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions.

CVE-2026-62001 is a critical vulnerability in ThemeREX Marcell versions up to 1.2.14 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.

CVE-2026-61998 is a critical vulnerability in ThemeREX Le Truffe versions up to 1.1.7 that allows unauthenticated PHP object injection due to deserialization of untrusted data. This flaw can lead to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-61997 is a critical vulnerability in ThemeREX Legal Stone versions up to 1.2.11 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected system.