ThemeREX vulnerabilities

Products

• ThemeREX Addons 6
• addons 4
• puzzles 3
• Puzzles | WP Magazine / Review with Store WordPress Theme + RTL 3
• Abelle 2
• Alliance 2
• Asia Garden 2
• Avventure 2
• Bonbon 2
• Booked 2
• Coinpress 2
• Edge Decor 2
• Education Center 2
• EmojiNation 2
• Equadio 2
• Filmax 2
• Gamezone 2
• Gamic 2
• Good Homes 2
• Gridiron 2
• Gunslinger 2
• Invetex 2
• Law Office 2
• Le Truffe 2
• Legal Stone 2
• Marcell 2
• Meals & Wheels 2
• Mission 2
• Motorix 2
• Muzicon 2

Latest ThemeREX CVEs

Newest publication first · page 1 of 10

1. CVE-2026-119526 WordPress Royal Event theme <= 2.0 - PHP Object Injection vulnerability

   Published 2026-10-30

   Critical·CVSS 9.8 EPSS 0.41%

   Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection. This issue affects Royal Event: from n/a through 2.0.

2. CVE-2026-62018 WordPress Gunslinger theme <= 1.11 - PHP Object Injection vulnerability

   Published 2026-10-29

   Critical·CVSS 9.8 EPSS 0.45%

   Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.

3. CVE-2026-62017 WordPress Good Homes theme <= 1.3.13 - PHP Object Injection vulnerability

   Published 2026-10-29

   Critical·CVSS 9.8 EPSS 0.42%

   Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.

4. CVE-2026-62016 WordPress Gamic theme <= 1.19 - PHP Object Injection vulnerability

   Published 2026-10-29

   Critical·CVSS 9.8 EPSS 0.40%

   Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.

5. CVE-2026-62014 WordPress EmojiNation theme <= 1.0.12 - PHP Object Injection vulnerability

   Published 2026-10-29

   Critical·CVSS 9.8 EPSS 0.43%

   Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions.

6. CVE-2026-62015 WordPress Gamezone theme <= 1.1.11 - PHP Object Injection vulnerability

   Published 2026-10-29

   Critical·CVSS 9.8 EPSS 0.40%

   Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.

7. CVE-2026-62013 WordPress Edge Decor theme <= 2.9 - PHP Object Injection vulnerability

   Published 2026-10-29

   Critical·CVSS 9.8 EPSS 0.45%

   Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions.

8. CVE-2026-62012 WordPress Coinpress theme <= 1.0.15 - PHP Object Injection vulnerability

   Published 2026-10-29

   Critical·CVSS 9.8 EPSS 0.42%

   Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions.

9. CVE-2026-62011 WordPress Bonbon theme <= 1.11 - PHP Object Injection vulnerability

   Published 2026-10-29

   Critical·CVSS 9.8 EPSS 0.40%

   Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions.

10. CVE-2026-62010 WordPress Avventure theme <= 1.1.12 - PHP Object Injection vulnerability

    Published 2026-10-29

    Critical·CVSS 9.8 EPSS 0.40%

    Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions.

11. CVE-2026-62009 WordPress Filmax theme <= 1.1.11 - PHP Object Injection vulnerability

    Published 2026-10-29

    Critical·CVSS 9.8 EPSS 0.43%

    Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions.

12. CVE-2026-62008 WordPress Orpheus theme <= 1.8 - PHP Object Injection vulnerability

    Published 2026-10-29

    Critical·CVSS 9.8 EPSS 0.42%

    Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.

13. CVE-2026-62005 WordPress Muzicon theme <= 1.15 - PHP Object Injection vulnerability

    Published 2026-10-29

    Critical·CVSS 9.8 EPSS 0.40%

    Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.

14. CVE-2026-62006 WordPress Nuts theme <= 1.12 - PHP Object Injection vulnerability

    Published 2026-10-29

    Critical·CVSS 9.8 EPSS 0.42%

    Unauthenticated PHP Object Injection in Nuts <= 1.12 versions.

15. CVE-2026-62004 WordPress Motorix theme <= 1.11 - PHP Object Injection vulnerability

    Published 2026-10-29

    Critical·CVSS 9.8 EPSS 0.40%

    Unauthenticated PHP Object Injection in Motorix <= 1.11 versions.

16. CVE-2026-62003 WordPress Mission theme <= 1.22 - PHP Object Injection vulnerability

    Published 2026-10-29

    Critical·CVSS 9.8 EPSS 0.40%

    Unauthenticated PHP Object Injection in Mission <= 1.22 versions.

17. CVE-2026-62001 WordPress Marcell theme <= 1.2.14 - PHP Object Injection vulnerability

    Published 2026-10-29

    Critical·CVSS 9.8 EPSS 0.48%

    Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.

18. CVE-2026-62002 WordPress Meals & Wheels theme <= 1.1.13 - PHP Object Injection vulnerability

    Published 2026-10-29

    Critical·CVSS 9.8 EPSS 0.51%

    Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions.

19. CVE-2026-61998 WordPress Le Truffe theme <= 1.1.7 - PHP Object Injection vulnerability

    Published 2026-10-29

    Critical·CVSS 9.8 EPSS 0.48%

    Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions.

20. CVE-2026-61997 WordPress Legal Stone theme <= 1.2.11 - PHP Object Injection vulnerability

    Published 2026-10-29

    Critical·CVSS 9.8 EPSS 0.51%

    Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions.

21. CVE-2026-54860 WordPress Ozisti theme <= 1.1.10 - PHP Object Injection vulnerability

    Published 2026-10-29

    Critical·CVSS 9.8 EPSS 0.49%

    Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions.

22. CVE-2026-54859 WordPress Preservation theme <= 1.15 - PHP Object Injection vulnerability

    Published 2026-10-29

    Critical·CVSS 9.8 EPSS 0.53%

    Unauthenticated PHP Object Injection in Preservation <= 1.15 versions.

23. CVE-2026-54858 WordPress Printy theme <= 1.13.0 - PHP Object Injection vulnerability

    Published 2026-10-29

    Critical·CVSS 9.8 EPSS 0.49%

    Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions.

24. CVE-2026-54857 WordPress Quirky theme <= 1.23 - PHP Object Injection vulnerability

    Published 2026-10-29

    Critical·CVSS 9.8 EPSS 0.49%

    Unauthenticated PHP Object Injection in Quirky <= 1.23 versions.

25. CVE-2026-54856 WordPress RexCoin theme <= 1.2.6 - PHP Object Injection vulnerability

    Published 2026-10-29

    Critical·CVSS 9.8 EPSS 0.49%

    Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.