Patchfirst: ThemeREX vulnerabilitieshttps://patchfirst.co/vendor/themerex/New and newly exploited ThemeREX CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMTCVE-2026-119526: Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injectionhttps://patchfirst.co/cve/CVE-2026-119526/CVE-2026-119526Fri, 30 Oct 2026 00:00:00 GMTThemeREX · Royal Event. Not in CISA KEV. No EPSS score. CVSS 9.8 CRITICAL. Priority 6.9 of 100.CVE-2026-54859: Unauthenticated PHP Object Injection in Preservation <= 1.15 versionshttps://patchfirst.co/cve/CVE-2026-54859/CVE-2026-54859Thu, 29 Oct 2026 00:00:00 GMTThemeREX · Preservation. Not in CISA KEV. EPSS 0.5% (higher than 44.6% of CVEs). CVSS 9.8 CRITICAL. Priority 16.5 of 100.CVE-2026-62002: Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versionshttps://patchfirst.co/cve/CVE-2026-62002/CVE-2026-62002Thu, 29 Oct 2026 00:00:00 GMTThemeREX · Meals & Wheels. Not in CISA KEV. EPSS 0.5% (higher than 43.6% of CVEs). CVSS 9.8 CRITICAL. Priority 16.3 of 100.CVE-2026-61997: Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versionshttps://patchfirst.co/cve/CVE-2026-61997/CVE-2026-61997Thu, 29 Oct 2026 00:00:00 GMTThemeREX · Legal Stone. Not in CISA KEV. EPSS 0.5% (higher than 43.6% of CVEs). CVSS 9.8 CRITICAL. Priority 16.3 of 100.CVE-2026-54860: Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versionshttps://patchfirst.co/cve/CVE-2026-54860/CVE-2026-54860Thu, 29 Oct 2026 00:00:00 GMTThemeREX · Ozisti. Not in CISA KEV. EPSS 0.5% (higher than 42.2% of CVEs). CVSS 9.8 CRITICAL. Priority 16.0 of 100.CVE-2026-54858: Unauthenticated PHP Object Injection in Printy <= 1.13.0 versionshttps://patchfirst.co/cve/CVE-2026-54858/CVE-2026-54858Thu, 29 Oct 2026 00:00:00 GMTThemeREX · Printy. Not in CISA KEV. EPSS 0.5% (higher than 42.2% of CVEs). CVSS 9.8 CRITICAL. Priority 16.0 of 100.CVE-2026-54857: Unauthenticated PHP Object Injection in Quirky <= 1.23 versionshttps://patchfirst.co/cve/CVE-2026-54857/CVE-2026-54857Thu, 29 Oct 2026 00:00:00 GMTThemeREX · Quirky. Not in CISA KEV. EPSS 0.5% (higher than 42.2% of CVEs). CVSS 9.8 CRITICAL. Priority 16.0 of 100.CVE-2026-54856: Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versionshttps://patchfirst.co/cve/CVE-2026-54856/CVE-2026-54856Thu, 29 Oct 2026 00:00:00 GMTThemeREX · RexCoin. Not in CISA KEV. EPSS 0.5% (higher than 42.2% of CVEs). CVSS 9.8 CRITICAL. Priority 16.0 of 100.CVE-2026-62001: Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versionshttps://patchfirst.co/cve/CVE-2026-62001/CVE-2026-62001Thu, 29 Oct 2026 00:00:00 GMTThemeREX · Marcell. Not in CISA KEV. EPSS 0.5% (higher than 41.1% of CVEs). CVSS 9.8 CRITICAL. Priority 15.8 of 100.CVE-2026-61998: Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versionshttps://patchfirst.co/cve/CVE-2026-61998/CVE-2026-61998Thu, 29 Oct 2026 00:00:00 GMTThemeREX · Le Truffe. Not in CISA KEV. EPSS 0.5% (higher than 41.1% of CVEs). CVSS 9.8 CRITICAL. Priority 15.8 of 100.CVE-2026-62018: Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versionshttps://patchfirst.co/cve/CVE-2026-62018/CVE-2026-62018Thu, 29 Oct 2026 00:00:00 GMTThemeREX · Gunslinger. Not in CISA KEV. EPSS 0.4% (higher than 39.1% of CVEs). CVSS 9.8 CRITICAL. Priority 15.4 of 100.CVE-2026-62013: Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versionshttps://patchfirst.co/cve/CVE-2026-62013/CVE-2026-62013Thu, 29 Oct 2026 00:00:00 GMTThemeREX · Edge Decor. Not in CISA KEV. EPSS 0.4% (higher than 39.1% of CVEs). CVSS 9.8 CRITICAL. Priority 15.4 of 100.CVE-2026-62014: Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versionshttps://patchfirst.co/cve/CVE-2026-62014/CVE-2026-62014Thu, 29 Oct 2026 00:00:00 GMTThemeREX · EmojiNation. Not in CISA KEV. EPSS 0.4% (higher than 36.8% of CVEs). CVSS 9.8 CRITICAL. Priority 14.9 of 100.CVE-2026-62009: Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versionshttps://patchfirst.co/cve/CVE-2026-62009/CVE-2026-62009Thu, 29 Oct 2026 00:00:00 GMTThemeREX · Filmax. Not in CISA KEV. EPSS 0.4% (higher than 36.8% of CVEs). CVSS 9.8 CRITICAL. Priority 14.9 of 100.CVE-2026-62017: Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versionshttps://patchfirst.co/cve/CVE-2026-62017/CVE-2026-62017Thu, 29 Oct 2026 00:00:00 GMTThemeREX · Good Homes. Not in CISA KEV. EPSS 0.4% (higher than 36.2% of CVEs). CVSS 9.8 CRITICAL. Priority 14.8 of 100.CVE-2026-62012: Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versionshttps://patchfirst.co/cve/CVE-2026-62012/CVE-2026-62012Thu, 29 Oct 2026 00:00:00 GMTThemeREX · Coinpress. Not in CISA KEV. EPSS 0.4% (higher than 36.2% of CVEs). CVSS 9.8 CRITICAL. Priority 14.8 of 100.CVE-2026-62008: Unauthenticated PHP Object Injection in Orpheus <= 1.8 versionshttps://patchfirst.co/cve/CVE-2026-62008/CVE-2026-62008Thu, 29 Oct 2026 00:00:00 GMTThemeREX · Orpheus. Not in CISA KEV. EPSS 0.4% (higher than 36.2% of CVEs). CVSS 9.8 CRITICAL. Priority 14.8 of 100.CVE-2026-62006: Unauthenticated PHP Object Injection in Nuts <= 1.12 versionshttps://patchfirst.co/cve/CVE-2026-62006/CVE-2026-62006Thu, 29 Oct 2026 00:00:00 GMTThemeREX · Nuts. Not in CISA KEV. EPSS 0.4% (higher than 36.2% of CVEs). CVSS 9.8 CRITICAL. Priority 14.8 of 100.CVE-2026-62016: Unauthenticated PHP Object Injection in Gamic <= 1.19 versionshttps://patchfirst.co/cve/CVE-2026-62016/CVE-2026-62016Thu, 29 Oct 2026 00:00:00 GMTThemeREX · Gamic. Not in CISA KEV. EPSS 0.4% (higher than 33.8% of CVEs). CVSS 9.8 CRITICAL. Priority 14.3 of 100.CVE-2026-62015: Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versionshttps://patchfirst.co/cve/CVE-2026-62015/CVE-2026-62015Thu, 29 Oct 2026 00:00:00 GMTThemeREX · Gamezone. Not in CISA KEV. EPSS 0.4% (higher than 33.8% of CVEs). CVSS 9.8 CRITICAL. Priority 14.3 of 100.CVE-2026-62011: Unauthenticated PHP Object Injection in Bonbon <= 1.11 versionshttps://patchfirst.co/cve/CVE-2026-62011/CVE-2026-62011Thu, 29 Oct 2026 00:00:00 GMTThemeREX · Bonbon. Not in CISA KEV. EPSS 0.4% (higher than 33.8% of CVEs). CVSS 9.8 CRITICAL. Priority 14.3 of 100.CVE-2026-62010: Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versionshttps://patchfirst.co/cve/CVE-2026-62010/CVE-2026-62010Thu, 29 Oct 2026 00:00:00 GMTThemeREX · Avventure. Not in CISA KEV. EPSS 0.4% (higher than 33.8% of CVEs). CVSS 9.8 CRITICAL. Priority 14.3 of 100.CVE-2026-62005: Unauthenticated PHP Object Injection in Muzicon <= 1.15 versionshttps://patchfirst.co/cve/CVE-2026-62005/CVE-2026-62005Thu, 29 Oct 2026 00:00:00 GMTThemeREX · Muzicon. Not in CISA KEV. EPSS 0.4% (higher than 33.8% of CVEs). CVSS 9.8 CRITICAL. Priority 14.3 of 100.CVE-2026-62004: Unauthenticated PHP Object Injection in Motorix <= 1.11 versionshttps://patchfirst.co/cve/CVE-2026-62004/CVE-2026-62004Thu, 29 Oct 2026 00:00:00 GMTThemeREX · Motorix. Not in CISA KEV. EPSS 0.4% (higher than 33.8% of CVEs). CVSS 9.8 CRITICAL. Priority 14.3 of 100.CVE-2026-62003: Unauthenticated PHP Object Injection in Mission <= 1.22 versionshttps://patchfirst.co/cve/CVE-2026-62003/CVE-2026-62003Thu, 29 Oct 2026 00:00:00 GMTThemeREX · Mission. Not in CISA KEV. EPSS 0.4% (higher than 33.8% of CVEs). CVSS 9.8 CRITICAL. Priority 14.3 of 100.CVE-2026-112847: Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue affects…https://patchfirst.co/cve/CVE-2026-112847/CVE-2026-112847Fri, 23 Oct 2026 00:00:00 GMTThemeREX · ZenSoul. Not in CISA KEV. EPSS 0.3% (higher than 24.3% of CVEs). CVSS 9.8 CRITICAL. Priority 13.5 of 100.CVE-2026-62090: Unauthenticated PHP Object Injection in WineShop <= 3.20 versionshttps://patchfirst.co/cve/CVE-2026-62090/CVE-2026-62090Sat, 10 Oct 2026 00:00:00 GMTThemeREX · WineShop. Not in CISA KEV. EPSS 0.4% (higher than 31.5% of CVEs). CVSS 9.8 CRITICAL. Priority 15.5 of 100.CVE-2026-62087: Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versionshttps://patchfirst.co/cve/CVE-2026-62087/CVE-2026-62087Sat, 10 Oct 2026 00:00:00 GMTThemeREX · Equadio. Not in CISA KEV. EPSS 0.4% (higher than 31.5% of CVEs). CVSS 9.8 CRITICAL. Priority 15.5 of 100.CVE-2026-62086: Unauthenticated PHP Object Injection in Juno <= 2.25 versionshttps://patchfirst.co/cve/CVE-2026-62086/CVE-2026-62086Sat, 10 Oct 2026 00:00:00 GMTThemeREX · Juno. Not in CISA KEV. EPSS 0.4% (higher than 31.5% of CVEs). CVSS 9.8 CRITICAL. Priority 15.5 of 100.CVE-2026-62054: Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versionshttps://patchfirst.co/cve/CVE-2026-62054/CVE-2026-62054Sat, 10 Oct 2026 00:00:00 GMTThemeREX · Yacht Rental. Not in CISA KEV. EPSS 0.4% (higher than 31.5% of CVEs). CVSS 9.8 CRITICAL. Priority 15.5 of 100.CVE-2026-62053: Unauthenticated PHP Object Injection in Wine House <= 3.20 versionshttps://patchfirst.co/cve/CVE-2026-62053/CVE-2026-62053Sat, 10 Oct 2026 00:00:00 GMTThemeREX · Wine House. Not in CISA KEV. EPSS 0.4% (higher than 31.5% of CVEs). CVSS 9.8 CRITICAL. Priority 15.5 of 100.CVE-2026-62052: Unauthenticated PHP Object Injection in Tipsy <= 1.6 versionshttps://patchfirst.co/cve/CVE-2026-62052/CVE-2026-62052Sat, 10 Oct 2026 00:00:00 GMTThemeREX · Tipsy. Not in CISA KEV. EPSS 0.4% (higher than 31.5% of CVEs). CVSS 9.8 CRITICAL. Priority 15.5 of 100.CVE-2026-62051: Unauthenticated PHP Object Injection in Stargaze <= 1.10 versionshttps://patchfirst.co/cve/CVE-2026-62051/CVE-2026-62051Sat, 10 Oct 2026 00:00:00 GMTThemeREX · Stargaze. Not in CISA KEV. EPSS 0.4% (higher than 31.5% of CVEs). CVSS 9.8 CRITICAL. Priority 15.5 of 100.CVE-2026-62050: Unauthenticated PHP Object Injection in Splendour <= 1.23 versionshttps://patchfirst.co/cve/CVE-2026-62050/CVE-2026-62050Sat, 10 Oct 2026 00:00:00 GMTThemeREX · Splendour. Not in CISA KEV. EPSS 0.4% (higher than 31.5% of CVEs). CVSS 9.8 CRITICAL. Priority 15.5 of 100.CVE-2026-78535: Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versionshttps://patchfirst.co/cve/CVE-2026-78535/CVE-2026-78535Sat, 10 Oct 2026 00:00:00 GMTThemeRex · Photolia. Not in CISA KEV. EPSS 0.3% (higher than 26% of CVEs). CVSS 9.8 CRITICAL. Priority 14.4 of 100.CVE-2026-81797: Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versionshttps://patchfirst.co/cve/CVE-2026-81797/CVE-2026-81797Sat, 10 Oct 2026 00:00:00 GMTThemeRex · Buzz Stone | Magazine & Viral Blog WordPress Theme. Not in CISA KEV. EPSS 0.3% (higher than 23.9% of CVEs). CVSS 9.8 CRITICAL. Priority 14.0 of 100.CVE-2026-78531: Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versionshttps://patchfirst.co/cve/CVE-2026-78531/CVE-2026-78531Sat, 10 Oct 2026 00:00:00 GMTThemeREX · Jacqueline. Not in CISA KEV. EPSS 0.3% (higher than 23.2% of CVEs). CVSS 9.8 CRITICAL. Priority 13.9 of 100.CVE-2026-78529: Unauthenticated PHP Object Injection in Alliance <= 3.11 versionshttps://patchfirst.co/cve/CVE-2026-78529/CVE-2026-78529Sat, 10 Oct 2026 00:00:00 GMTThemeREX · Alliance. Not in CISA KEV. EPSS 0.3% (higher than 23.2% of CVEs). CVSS 9.8 CRITICAL. Priority 13.9 of 100.CVE-2026-66564: Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versionshttps://patchfirst.co/cve/CVE-2026-66564/CVE-2026-66564Sat, 10 Oct 2026 00:00:00 GMTThemeREX · ShiftCV. Not in CISA KEV. EPSS 0.3% (higher than 23.2% of CVEs). CVSS 9.8 CRITICAL. Priority 13.9 of 100.CVE-2026-66563: Unauthenticated PHP Object Injection in Windsor <= 2.10 versionshttps://patchfirst.co/cve/CVE-2026-66563/CVE-2026-66563Sat, 10 Oct 2026 00:00:00 GMTThemeREX · Windsor. Not in CISA KEV. EPSS 0.3% (higher than 23.2% of CVEs). CVSS 9.8 CRITICAL. Priority 13.9 of 100.CVE-2026-66483: Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versionshttps://patchfirst.co/cve/CVE-2026-66483/CVE-2026-66483Sat, 10 Oct 2026 00:00:00 GMTThemeREX · Education Center. Not in CISA KEV. EPSS 0.3% (higher than 23.2% of CVEs). CVSS 9.8 CRITICAL. Priority 13.9 of 100.CVE-2026-62125: Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versionshttps://patchfirst.co/cve/CVE-2026-62125/CVE-2026-62125Sat, 10 Oct 2026 00:00:00 GMTThemeREX · Asia Garden. Not in CISA KEV. EPSS 0.3% (higher than 23.2% of CVEs). CVSS 9.8 CRITICAL. Priority 13.9 of 100.CVE-2026-62124: Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versionshttps://patchfirst.co/cve/CVE-2026-62124/CVE-2026-62124Sat, 10 Oct 2026 00:00:00 GMTThemeREX · N7 | Golf Club Sports & Events. Not in CISA KEV. EPSS 0.3% (higher than 23.2% of CVEs). CVSS 9.8 CRITICAL. Priority 13.9 of 100.CVE-2026-62123: Unauthenticated PHP Object Injection in Invetex <= 2.18 versionshttps://patchfirst.co/cve/CVE-2026-62123/CVE-2026-62123Sat, 10 Oct 2026 00:00:00 GMTThemeREX · Invetex. Not in CISA KEV. EPSS 0.3% (higher than 23.2% of CVEs). CVSS 9.8 CRITICAL. Priority 13.9 of 100.CVE-2026-62120: Unauthenticated PHP Object Injection in Law Office <= 3.20 versionshttps://patchfirst.co/cve/CVE-2026-62120/CVE-2026-62120Sat, 10 Oct 2026 00:00:00 GMTThemeREX · Law Office. Not in CISA KEV. EPSS 0.3% (higher than 23.2% of CVEs). CVSS 9.8 CRITICAL. Priority 13.9 of 100.CVE-2024-13448: ThemeREX Addons <= 2.32.3 - Unauthenticated Arbitrary File Upload in trx_addons_uploads_save_datahttps://patchfirst.co/cve/CVE-2024-13448/CVE-2024-13448Tue, 28 Jan 2025 00:00:00 GMTThemeREX · ThemeREX Addons. Not in CISA KEV. EPSS 0.9% (higher than 59.3% of CVEs). CVSS 9.8 CRITICAL. Priority 58.7 of 100.