Threat database

CVE-2026-57742 is a high-severity reflected cross-site scripting (XSS) vulnerability in ThemeREX Group's Kids Planet product. It allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The vulnerability affects versions up to and including 2.2.14.2. No patch or remediation information is currently provided.

CVE-2026-81797 is a critical vulnerability in the ThemeRex Buzz Stone | Magazine & Viral Blog WordPress Theme version 1.0.2 and earlier. It involves unauthenticated PHP object injection due to deserialization of untrusted data, which can lead to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-78535 is a critical vulnerability in ThemeRex Photolia versions up to 1.0.3 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.

CVE-2026-78531 is a critical vulnerability in ThemeREX Jacqueline versions up to 2.22 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.

CVE-2026-78529 is a critical vulnerability in ThemeREX Alliance versions up to and including 3.11. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data, classified under CWE-502. The vulnerability allows remote attackers to execute arbitrary code without any authentication.

CVE-2026-66564 is a critical unauthenticated PHP Object Injection vulnerability affecting ThemeREX ShiftCV versions up to and including 3.0.14. This vulnerability involves deserialization of untrusted data, which can lead to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-66563 is a critical vulnerability in ThemeREX Windsor versions up to 2.10 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.

CVE-2026-66483 is a critical vulnerability in ThemeREX Education Center versions up to 3.6.12. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data, allowing an attacker to execute arbitrary code without authentication.

CVE-2026-62125 is a critical vulnerability in ThemeREX Asia Garden versions up to 1.3.1 that allows unauthenticated PHP object injection due to deserialization of untrusted data. This flaw can lead to full compromise of confidentiality, integrity, and availability without requiring user interaction or privileges.

CVE-2026-62124 is a critical vulnerability in ThemeREX's N7 | Golf Club Sports & Events plugin, affecting versions up to 2.21. It involves unauthenticated PHP Object Injection due to deserialization of untrusted data, which can lead to full system compromise. The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability.

CVE-2026-62123 is a critical vulnerability in ThemeREX's Invetex product, affecting versions up to 2.18. It involves unauthenticated PHP object injection due to deserialization of untrusted data, which can lead to full system compromise without requiring user interaction.

CVE-2026-62120 is a critical vulnerability in ThemeREX Law Office versions up to 3.20 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-62090 is a critical vulnerability in ThemeREX WineShop versions up to 3.20 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.

CVE-2026-62087 is a critical vulnerability in ThemeREX Equadio versions up to 1.1.4 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to complete compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-62086 is a critical vulnerability in ThemeREX Juno versions up to 2.25, involving unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw allows remote attackers to execute arbitrary code without authentication, impacting confidentiality, integrity, and availability.

CVE-2026-62074 is a high severity vulnerability in ThemeREX Ozeum versions up to and including 1.3.0. It involves an unauthenticated Local File Inclusion (LFI) flaw due to improper control of filenames in include/require statements in PHP. This vulnerability can lead to remote file inclusion attacks, potentially allowing attackers to execute arbitrary code or access sensitive information.

CVE-2026-62054 is a critical vulnerability in ThemeREX Yacht Rental versions up to 2.6 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-62053 is a critical vulnerability in ThemeREX Wine House versions up to 3.20 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.

CVE-2026-62052 is a critical vulnerability in ThemeREX Tipsy versions 1.6 and earlier that allows unauthenticated PHP object injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.

CVE-2026-62051 is a critical vulnerability in ThemeREX Stargaze versions up to 1.10 that allows unauthenticated PHP Object Injection due to deserialization of untrusted data. This flaw can lead to full system compromise without requiring user interaction or privileges.