Advisories · Technology

ThemeREX Addons.

Every CVE that names ThemeREX Addons among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-97236 CVE record

CVSS 6.5 Medium

WordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scripting (XSS) vulnerability
- ThemeREX Addons
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-97235 CVE record

CVSS 7.1 High

WordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scripting (XSS) vulnerability
- ThemeREX Addons
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-62105 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

WordPress ThemeREX Addons plugin < 2.45.0 - PHP Object Injection vulnerability
- ThemeREX Addons
- Insecure deserialization
Not analysed yet 11 Sept 2026
CVE-2025-6997 CVE record

CVSS 6.4 Medium

ThemeREX Addons <= 2.35.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via trx_addons_get_svg_from_file Function
- ThemeREX Addons
- Cross-site scripting (XSS)
Not analysed yet 19 Jul 2025
CVE-2024-13448 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

ThemeREX Addons <= 2.32.3 - Unauthenticated Arbitrary File Upload in trx_addons_uploads_save_data
- ThemeREX Addons
- Unrestricted file upload
Not analysed yet 28 Jan 2025
CVE-2025-0682 CVE record

CVSS 8.8 High

ThemeREX Addons <= 2.33.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode
- ThemeREX Addons
- File inclusion
Not analysed yet 25 Jan 2025