ThemeREX records
7 published records for vendor themerex.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 2
- With a fix record
- 0%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')2
- CWE-434 Unrestricted Upload of File with Dangerous Type1
- CWE-502 Deserialization of Untrusted Data1
- CWE-862 Missing Authorization1
- CWE-94 Improper Control of Generation of Code ('Code Injection')1
- CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')1
The weakness classes this vendor ships most often: where to look.
CWEAll records
7 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
42Plan | CVE-2020-10257Proof of concept | The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowthemerex · addons · CWE-94 | Critical9.8 | — | 8.8% | Mar 9, 2020 |
39Monitor | CVE-2024-13448No exploit | ThemeREX Addons <= 2.32.3 - Unauthenticated Arbitrary File Upload in trx_addons_uploads_save_datathemerex · addons · CWE-434 | Critical9.8 | — | 0.9% | Jan 28, 2025 |
39Monitor | CVE-2024-13770No exploit | Puzzles | WP Magazine / Review with Store WordPress Theme + RTL <= 4.2.4 - Unauthenticated PHP Object Injectionthemerex · puzzles · CWE-502 | Critical9.8 | — | 0.8% | Feb 13, 2025 |
35Monitor | CVE-2025-0682No exploit | ThemeREX Addons <= 2.33.0 - Authenticated (Contributor+) Local File Inclusion via Shortcodethemerex · addons · CWE-98 | High8.8 | — | 0.6% | Jan 25, 2025 |
21Monitor | CVE-2024-13769No exploit | Puzzles | WP Magazine / Review with Store WordPress Theme + RTL <= 4.2.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scriptingthemerex · puzzles · CWE-862 | Medium5.4 | — | 0.2% | Feb 12, 2025 |
21Monitor | CVE-2025-0837No exploit | Puzzles <= 4.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodethemerex · puzzles · CWE-79 | Medium5.4 | — | 0.2% | Feb 13, 2025 |
21Monitor | CVE-2025-6997No exploit | ThemeREX Addons <= 2.35.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via trx_addons_get_svg_from_file Functionthemerex · addons · CWE-79 | Medium5.4 | — | 0.2% | Jul 19, 2025 |
- CVE-2020-1025742Plan
The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allow
CriticalCVSS 9.8Proof of conceptEPSS 8%themerex · addonsMar 9, 2020
- CVE-2024-1344839Monitor
ThemeREX Addons <= 2.32.3 - Unauthenticated Arbitrary File Upload in trx_addons_uploads_save_data
CriticalCVSS 9.8No exploitEPSS 0%themerex · addonsJan 28, 2025
- CVE-2024-1377039Monitor
Puzzles | WP Magazine / Review with Store WordPress Theme + RTL <= 4.2.4 - Unauthenticated PHP Object Injection
CriticalCVSS 9.8No exploitEPSS 0%themerex · puzzlesFeb 13, 2025
- CVE-2025-068235Monitor
ThemeREX Addons <= 2.33.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode
HighCVSS 8.8No exploitEPSS 0%themerex · addonsJan 25, 2025
- CVE-2024-1376921Monitor
Puzzles | WP Magazine / Review with Store WordPress Theme + RTL <= 4.2.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
MediumCVSS 5.4No exploitEPSS 0%themerex · puzzlesFeb 12, 2025
- CVE-2025-083721Monitor
Puzzles <= 4.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
MediumCVSS 5.4No exploitEPSS 0%themerex · puzzlesFeb 13, 2025
- CVE-2025-699721Monitor
ThemeREX Addons <= 2.35.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via trx_addons_get_svg_from_file Function
MediumCVSS 5.4No exploitEPSS 0%themerex · addonsJul 19, 2025