ThemeREX Addons

ThemeREX Addons has 5 disclosed vulnerabilities in the WordSec catalog, reported between 2020 and 2026; all 5 are fixed as of September 2026. Their average CVSS score is 8.9, and the most serious one scores 9.8 out of 10. Severity breakdown: 3 critical and 1 high. 2025 was the busiest year with 3 disclosures.

The most common weakness is Unrestricted Upload Of File With Dangerous Type, behind 2 of the records (40%). Other recurring categories include Cross-Site Scripting, Missing Authorization.

Every one of the 5 issues recorded for ThemeREX Addons has a vendor fix available, so running the current release closes all known holes.

5 independent researchers contributed these findings, one record each.

Strategic Overview

Avg CVSSHigh

8.9/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all ThemeREX Addons vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2026-1969

ThemeREX Addons < 2.38.5 - Unauthenticated Arbitrary File Upload

Read the full analysis

Vulnerability Records

5 records


2026-03-30 00:00	ThemeREX Addons < 2.38.5 - Unauthenticated Arbitrary File Upload ThemeREX Addons < 2.38.5	`CVE-2026-1969`	9.8 Critical	Erwan LR	Yes
2025-07-18 19:52	ThemeREX Addons <= 2.35.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via trx_addons_get_svg_from_file Function ThemeREX Addons <= 2.35.1.1	`CVE-2025-6997`	6.4 Medium	stealthcopter	Yes
2025-01-27 00:00	ThemeREX Addons <= 2.32.3 - Unauthenticated Arbitrary File Upload in trx_addons_uploads_save_data ThemeREX Addons <= 2.32.3	`CVE-2024-13448`	9.8 Critical	Tonn	Yes
2025-01-24 00:00	ThemeREX Addons <= 2.33.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode ThemeREX Addons <= 2.33.0	`CVE-2025-0682`	8.8 High	István Márton	Yes
2020-03-09 00:00	ThemeREX Addons (Various Versions) - Missing Authorization ThemeREX Addons 1.6.49.6 – 1.70.3 · 25 branches	`CVE-2020-10257`	9.8 Critical	Chloe Chamberland	Yes

Showing 1–5 of 5 reports