ThemeREX Addons
by WordPress
CVEs (10)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-62105 | Cri | 0.64 | 9.8 | 0.01 | Sep 11, 2026 | Unauthenticated PHP Object Injection in ThemeREX Addons < 2.45.0 versions. | ||
| CVE-2025-60205 | Cri | 0.64 | 9.8 | 0.01 | Jun 17, 2026 | Deserialization of Untrusted Data vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Object Injection.This issue affects ThemeREX Addons: from n/a through 2.36.1.1. | ||
| CVE-2024-13448 | Cri | 0.64 | 9.8 | 0.01 | Jan 28, 2025 | The ThemeREX Addons plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'trx_addons_uploads_save_data' function in all versions up to, and including, 2.32.3. This makes it possible for unauthenticated attackers to upload… | ||
| CVE-2020-10257 | Cri | 0.64 | 9.8 | 0.09 | Mar 10, 2020 | The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe… | ||
| CVE-2025-0682 | Hig | 0.57 | 8.8 | 0.01 | Jan 25, 2025 | The ThemeREX Addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.33.0 via the 'trx_sc_reviews' shortcode 'type' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to… | ||
| CVE-2026-97235 | Hig | 0.46 | 7.1 | 0.00 | Sep 30, 2026 | Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions. | ||
| CVE-2026-102798 | Med | 0.42 | 6.5 | 0.00 | Oct 2, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Stored XSS.This issue affects ThemeREX Addons: from n/a through 2.46.0. | ||
| CVE-2026-102797 | Med | 0.42 | 6.4 | 0.00 | Oct 2, 2026 | Server-Side Request Forgery (SSRF) vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Server Side Request Forgery.This issue affects ThemeREX Addons: from n/a through 2.46.0. | ||
| CVE-2026-97236 | Med | 0.42 | 6.5 | 0.00 | Sep 30, 2026 | Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions. | ||
| CVE-2025-6997 | Med | 0.42 | 6.4 | 0.00 | Jul 19, 2025 | The ThemeREX Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.35.1.1 due to insufficient input sanitization and output escaping. The plugin’s SVG rendering routine calls the… |
- risk 0.64cvss 9.8epss 0.01
Unauthenticated PHP Object Injection in ThemeREX Addons < 2.45.0 versions.
- risk 0.64cvss 9.8epss 0.01
Deserialization of Untrusted Data vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Object Injection.This issue affects ThemeREX Addons: from n/a through 2.36.1.1.
- risk 0.64cvss 9.8epss 0.01
The ThemeREX Addons plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'trx_addons_uploads_save_data' function in all versions up to, and including, 2.32.3. This makes it possible for unauthenticated attackers to upload…
- risk 0.64cvss 9.8epss 0.09
The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe…
- risk 0.57cvss 8.8epss 0.01
The ThemeREX Addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.33.0 via the 'trx_sc_reviews' shortcode 'type' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to…
- risk 0.46cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.
- risk 0.42cvss 6.5epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Stored XSS.This issue affects ThemeREX Addons: from n/a through 2.46.0.
- risk 0.42cvss 6.4epss 0.00
Server-Side Request Forgery (SSRF) vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Server Side Request Forgery.This issue affects ThemeREX Addons: from n/a through 2.46.0.
- risk 0.42cvss 6.5epss 0.00
Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.
- risk 0.42cvss 6.4epss 0.00
The ThemeREX Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.35.1.1 due to insufficient input sanitization and output escaping. The plugin’s SVG rendering routine calls the…