ThemeREX Addons

ThemeREX Addons has 11 disclosed vulnerabilities in the WordSec catalog, reported between 2020 and 2026; all 11 are fixed as of October 2026. Their average CVSS score is 7.9, and the most serious one scores 9.8 out of 10. Severity breakdown: 3 critical and 4 high. 2026 was the busiest year with 6 disclosures.

The most common weakness is Cross-Site Scripting, behind 4 of the records (36%). Other recurring categories include Deserialization Of Untrusted Data, Unrestricted Upload Of File With Dangerous Type.

Every one of the 11 issues recorded for ThemeREX Addons has a vendor fix available, so running the current release closes all known holes.

7 independent researchers contributed these findings, most of them (5) reported by nh4tvd.

Strategic Overview

Avg CVSSHigh

7.9/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all ThemeREX Addons vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2026-1969

ThemeREX Addons < 2.38.5 - Unauthenticated Arbitrary File Upload

Read the full analysis

Vulnerability Records

11 records


2026-10-02 00:00	ThemeREX Addons <= 2.46.0 - Authenticated (Contributor+) Server-Side Request Forgery ThemeREX Addons <= 2.46.0	`CVE-2026-102797`	6.4 Medium	nh4tvd	Yes
2026-10-02 00:00	ThemeREX Addons <= 2.46.0 - Authenticated (Contributor+) Stored Cross-Site Scripting ThemeREX Addons <= 2.46.0	`CVE-2026-102798`	6.4 Medium	nh4tvd	Yes
2026-09-24 00:00	ThemeREX Addons < 2.45.0 - Unauthenticated Stored Cross-Site Scripting ThemeREX Addons < 2.45.0	`CVE-2026-97235`	7.2 High	nh4tvd	Yes
2026-09-24 00:00	ThemeREX Addons < 2.45.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting ThemeREX Addons < 2.45.0	`CVE-2026-97236`	6.4 Medium	nh4tvd	Yes
2026-09-11 00:00	ThemeREX Addons < 2.45.0 - Unauthenticated PHP Object Injection ThemeREX Addons < 2.45.0	`CVE-2026-62105`	8.1 High	nh4tvd	Yes
2026-03-30 00:00	ThemeREX Addons < 2.38.5 - Unauthenticated Arbitrary File Upload ThemeREX Addons < 2.38.5	`CVE-2026-1969`	9.8 Critical	Erwan LR	Yes
2025-08-27 00:00	ThemeREX Addons <= 2.36.1.1 - Unauthenticated PHP Object Injection ThemeREX Addons <= 2.36.1.1	`CVE-2025-60205`	8.1 High	Bonds	Yes
2025-07-18 19:52	ThemeREX Addons <= 2.35.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via trx_addons_get_svg_from_file Function ThemeREX Addons <= 2.35.1.1	`CVE-2025-6997`	6.4 Medium	stealthcopter	Yes
2025-01-27 00:00	ThemeREX Addons <= 2.32.3 - Unauthenticated Arbitrary File Upload in trx_addons_uploads_save_data ThemeREX Addons <= 2.32.3	`CVE-2024-13448`	9.8 Critical	Tonn	Yes
2025-01-24 00:00	ThemeREX Addons <= 2.33.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode ThemeREX Addons <= 2.33.0	`CVE-2025-0682`	8.8 High	István Márton	Yes

Showing 1–10 of 11 reports