{"schema_version":1,"title":"ThemeREX Group vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 29 vulnerabilities in ThemeREX Group: 0 in the last 7 days and 26 in the last 90 days, 22 of them critical and 0 exploited in the wild. The most recent, CVE-2026-112859, was published on 23 October 2026. 5 vulnerabilities in the last four weeks, down 76% on the four before (21). 4 critical against 17.","url":"https://junglewise.ai/threats/vendors/themerex-group","json_url":"https://junglewise.ai/threats/vendors/themerex-group.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/themerex-group","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","thin":false,"counts":{"high":4,"all_time":29,"critical":22,"exploited":0,"last_7_days":0,"last_30_days":5,"last_90_days":26,"last_365_days":29},"latest":[{"cve":"CVE-2026-112859","cvss":9.8,"slug":"cve-2026-112859-deserialization-of-untrusted-data-vulnerability-in-themerex","title":"ThemeREX Little Birdies PHP object injection","severity":"critical","exploited":false,"published_at":"2026-10-23T13:17:07.7+00:00","url":"https://junglewise.ai/threats/cve-2026-112859-deserialization-of-untrusted-data-vulnerability-in-themerex"},{"cve":"CVE-2026-112856","cvss":9.8,"slug":"cve-2026-112856-deserialization-of-untrusted-data-vulnerability-in-themerex","title":"ThemeREX Group Vagabonds PHP object injection","severity":"critical","exploited":false,"published_at":"2026-10-23T13:17:07.323+00:00","url":"https://junglewise.ai/threats/cve-2026-112856-deserialization-of-untrusted-data-vulnerability-in-themerex"},{"cve":"CVE-2026-112852","cvss":8.1,"slug":"cve-2026-112852-deserialization-of-untrusted-data-vulnerability-in-themerex","title":"ThemeREX Group Helion PHP object injection vulnerability","severity":"high","exploited":false,"published_at":"2026-10-23T13:17:06.817+00:00","url":"https://junglewise.ai/threats/cve-2026-112852-deserialization-of-untrusted-data-vulnerability-in-themerex"},{"cve":"CVE-2026-112851","cvss":9.8,"slug":"cve-2026-112851-deserialization-of-untrusted-data-vulnerability-in-themerex","title":"ThemeREX Group HotLock PHP object injection","severity":"critical","exploited":false,"published_at":"2026-10-23T13:17:06.697+00:00","url":"https://junglewise.ai/threats/cve-2026-112851-deserialization-of-untrusted-data-vulnerability-in-themerex"},{"cve":"CVE-2026-112846","cvss":9.8,"slug":"cve-2026-112846-deserialization-of-untrusted-data-vulnerability-in-themerex","title":"ThemeREX Save Life PHP object injection","severity":"critical","exploited":false,"published_at":"2026-10-23T13:17:06.057+00:00","url":"https://junglewise.ai/threats/cve-2026-112846-deserialization-of-untrusted-data-vulnerability-in-themerex"},{"cve":"CVE-2026-93944","cvss":9.8,"epss":0.0031,"slug":"cve-2026-93944-deserialization-of-untrusted-data-vulnerability-in-themerex-group","title":"ThemeREX Camelia PHP object injection","severity":"critical","exploited":false,"published_at":"2026-10-10T08:17:06.93+00:00","url":"https://junglewise.ai/threats/cve-2026-93944-deserialization-of-untrusted-data-vulnerability-in-themerex-group"},{"cve":"CVE-2026-93943","cvss":9.8,"epss":0.0031,"slug":"cve-2026-93943-deserialization-of-untrusted-data-vulnerability-in-themerex-group","title":"ThemeREX Group Convex PHP object injection vulnerability","severity":"critical","exploited":false,"published_at":"2026-10-10T08:17:06.803+00:00","url":"https://junglewise.ai/threats/cve-2026-93943-deserialization-of-untrusted-data-vulnerability-in-themerex-group"},{"cve":"CVE-2026-93942","cvss":9.8,"epss":0.0031,"slug":"cve-2026-93942-deserialization-of-untrusted-data-vulnerability-in-themerex-group","title":"ThemeREX Group Dwell PHP object injection","severity":"critical","exploited":false,"published_at":"2026-10-10T08:17:06.683+00:00","url":"https://junglewise.ai/threats/cve-2026-93942-deserialization-of-untrusted-data-vulnerability-in-themerex-group"},{"cve":"CVE-2026-93941","cvss":9.8,"epss":0.0033,"slug":"cve-2026-93941-deserialization-of-untrusted-data-vulnerability-in-themerex-group","title":"ThemeREX Edema theme PHP object injection","severity":"critical","exploited":false,"published_at":"2026-10-10T08:17:06.557+00:00","url":"https://junglewise.ai/threats/cve-2026-93941-deserialization-of-untrusted-data-vulnerability-in-themerex-group"},{"cve":"CVE-2026-93940","cvss":9.8,"epss":0.0033,"slug":"cve-2026-93940-deserialization-of-untrusted-data-vulnerability-in-themerex-group","title":"ThemeREX Greeny theme PHP object injection","severity":"critical","exploited":false,"published_at":"2026-10-10T08:17:06.433+00:00","url":"https://junglewise.ai/threats/cve-2026-93940-deserialization-of-untrusted-data-vulnerability-in-themerex-group"},{"cve":"CVE-2026-93938","cvss":9.8,"epss":0.0033,"slug":"cve-2026-93938-deserialization-of-untrusted-data-vulnerability-in-themerex-group","title":"ThemeREX Hogwords PHP object injection","severity":"critical","exploited":false,"published_at":"2026-10-10T08:17:06.31+00:00","url":"https://junglewise.ai/threats/cve-2026-93938-deserialization-of-untrusted-data-vulnerability-in-themerex-group"},{"cve":"CVE-2026-93937","cvss":9.8,"epss":0.0033,"slug":"cve-2026-93937-deserialization-of-untrusted-data-vulnerability-in-themerex-group","title":"ThemeREX Hygia PHP object injection vulnerability","severity":"critical","exploited":false,"published_at":"2026-10-10T08:17:06.187+00:00","url":"https://junglewise.ai/threats/cve-2026-93937-deserialization-of-untrusted-data-vulnerability-in-themerex-group"},{"cve":"CVE-2026-93936","cvss":9.8,"epss":0.0033,"slug":"cve-2026-93936-deserialization-of-untrusted-data-vulnerability-in-themerex-group","title":"ThemeREX Group IPharm PHP object injection","severity":"critical","exploited":false,"published_at":"2026-10-10T08:17:06.06+00:00","url":"https://junglewise.ai/threats/cve-2026-93936-deserialization-of-untrusted-data-vulnerability-in-themerex-group"},{"cve":"CVE-2026-93935","cvss":9.8,"epss":0.0031,"slug":"cve-2026-93935-deserialization-of-untrusted-data-vulnerability-in-themerex-group","title":"ThemeREX Let's Play theme PHP object injection","severity":"critical","exploited":false,"published_at":"2026-10-10T08:17:05.933+00:00","url":"https://junglewise.ai/threats/cve-2026-93935-deserialization-of-untrusted-data-vulnerability-in-themerex-group"},{"cve":"CVE-2026-93934","cvss":9.8,"epss":0.0031,"slug":"cve-2026-93934-deserialization-of-untrusted-data-vulnerability-in-themerex-group","title":"ThemeREX Partiso PHP object injection vulnerability","severity":"critical","exploited":false,"published_at":"2026-10-10T08:17:05.81+00:00","url":"https://junglewise.ai/threats/cve-2026-93934-deserialization-of-untrusted-data-vulnerability-in-themerex-group"},{"cve":"CVE-2026-93933","cvss":9.8,"epss":0.0031,"slug":"cve-2026-93933-deserialization-of-untrusted-data-vulnerability-in-themerex-group","title":"ThemeREX Group Rosalinda object injection via deserialization","severity":"critical","exploited":false,"published_at":"2026-10-10T08:17:05.68+00:00","url":"https://junglewise.ai/threats/cve-2026-93933-deserialization-of-untrusted-data-vulnerability-in-themerex-group"},{"cve":"CVE-2026-93932","cvss":9.8,"epss":0.0031,"slug":"cve-2026-93932-deserialization-of-untrusted-data-vulnerability-in-themerex-group","title":"ThemeREX Smart Casa PHP object injection vulnerability","severity":"critical","exploited":false,"published_at":"2026-10-10T08:17:05.547+00:00","url":"https://junglewise.ai/threats/cve-2026-93932-deserialization-of-untrusted-data-vulnerability-in-themerex-group"},{"cve":"CVE-2026-93931","cvss":9.8,"epss":0.0031,"slug":"cve-2026-93931-deserialization-of-untrusted-data-vulnerability-in-themerex-group","title":"ThemeREX Smash theme PHP object injection","severity":"critical","exploited":false,"published_at":"2026-10-10T08:17:05.427+00:00","url":"https://junglewise.ai/threats/cve-2026-93931-deserialization-of-untrusted-data-vulnerability-in-themerex-group"},{"cve":"CVE-2026-93930","cvss":9.8,"epss":0.0031,"slug":"cve-2026-93930-deserialization-of-untrusted-data-vulnerability-in-themerex-group","title":"ThemeREX Tantra theme object injection via deserialization","severity":"critical","exploited":false,"published_at":"2026-10-10T08:17:05.3+00:00","url":"https://junglewise.ai/threats/cve-2026-93930-deserialization-of-untrusted-data-vulnerability-in-themerex-group"},{"cve":"CVE-2026-93929","cvss":9.8,"epss":0.0032,"slug":"cve-2026-93929-deserialization-of-untrusted-data-vulnerability-in-themerex-group","title":"ThemeREX Group Travesia PHP object injection","severity":"critical","exploited":false,"published_at":"2026-10-10T08:17:05.183+00:00","url":"https://junglewise.ai/threats/cve-2026-93929-deserialization-of-untrusted-data-vulnerability-in-themerex-group"},{"cve":"CVE-2026-62046","cvss":9.8,"epss":0.0032,"slug":"cve-2026-62046-deserialization-of-untrusted-data-vulnerability-in-themerex-group","title":"ThemeREX Gutentype PHP object injection","severity":"critical","exploited":false,"published_at":"2026-10-10T08:17:04.777+00:00","url":"https://junglewise.ai/threats/cve-2026-62046-deserialization-of-untrusted-data-vulnerability-in-themerex-group"},{"cve":"CVE-2026-62045","cvss":9.8,"epss":0.0032,"slug":"cve-2026-62045-deserialization-of-untrusted-data-vulnerability-in-themerex-group","title":"ThemeREX Group Booklovers object injection through deserialization","severity":"critical","exploited":false,"published_at":"2026-10-10T08:17:04.647+00:00","url":"https://junglewise.ai/threats/cve-2026-62045-deserialization-of-untrusted-data-vulnerability-in-themerex-group"},{"cve":"CVE-2026-102798","cvss":6.5,"epss":0.0013,"slug":"cve-2026-102798-improper-neutralization-of-input-during-web-page-generation","title":"ThemeREX Addons stored cross-site scripting","severity":"medium","exploited":false,"published_at":"2026-10-02T13:17:22.883+00:00","url":"https://junglewise.ai/threats/cve-2026-102798-improper-neutralization-of-input-during-web-page-generation"},{"cve":"CVE-2026-102797","cvss":6.4,"epss":0.0014,"slug":"cve-2026-102797-server-side-request-forgery-ssrf-vulnerability-in-themerex-group","title":"ThemeREX Addons server-side request forgery","severity":"medium","exploited":false,"published_at":"2026-10-02T13:17:22.73+00:00","url":"https://junglewise.ai/threats/cve-2026-102797-server-side-request-forgery-ssrf-vulnerability-in-themerex-group"},{"cve":"CVE-2026-97236","cvss":6.5,"slug":"cve-2026-97236-subscriber-cross-site-scripting-xss-in-themerex-addons-2-45-0","title":"ThemeREX Addons stored cross-site scripting in comment form","severity":"medium","exploited":false,"published_at":"2026-09-30T13:17:35.227+00:00","url":"https://junglewise.ai/threats/cve-2026-97236-subscriber-cross-site-scripting-xss-in-themerex-addons-2-45-0"}],"vendor":{"hub":true,"name":"ThemeREX Group","slug":"themerex-group","description":"Software vendor providing WordPress themes and website solutions.","url":"https://junglewise.ai/threats/vendors/themerex-group"},"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":4},{"week":"2026-10-05","critical":17,"exploited":0,"vulnerabilities":17},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":4,"exploited":0,"vulnerabilities":5},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2026-39529","cvss":9.8,"epss":0.0051,"slug":"cve-2026-39529-themerex-group-elementra-php-object-injection","title":"ThemeREX Group Elementra PHP object injection","severity":"critical","exploited":false,"published_at":"2026-06-17T13:20:18.777+00:00","url":"https://junglewise.ai/threats/cve-2026-39529-themerex-group-elementra-php-object-injection"},{"cve":"CVE-2026-93941","cvss":9.8,"epss":0.0033,"slug":"cve-2026-93941-deserialization-of-untrusted-data-vulnerability-in-themerex-group","title":"ThemeREX Edema theme PHP object injection","severity":"critical","exploited":false,"published_at":"2026-10-10T08:17:06.557+00:00","url":"https://junglewise.ai/threats/cve-2026-93941-deserialization-of-untrusted-data-vulnerability-in-themerex-group"},{"cve":"CVE-2026-93940","cvss":9.8,"epss":0.0033,"slug":"cve-2026-93940-deserialization-of-untrusted-data-vulnerability-in-themerex-group","title":"ThemeREX Greeny theme PHP object injection","severity":"critical","exploited":false,"published_at":"2026-10-10T08:17:06.433+00:00","url":"https://junglewise.ai/threats/cve-2026-93940-deserialization-of-untrusted-data-vulnerability-in-themerex-group"},{"cve":"CVE-2026-93938","cvss":9.8,"epss":0.0033,"slug":"cve-2026-93938-deserialization-of-untrusted-data-vulnerability-in-themerex-group","title":"ThemeREX Hogwords PHP object injection","severity":"critical","exploited":false,"published_at":"2026-10-10T08:17:06.31+00:00","url":"https://junglewise.ai/threats/cve-2026-93938-deserialization-of-untrusted-data-vulnerability-in-themerex-group"},{"cve":"CVE-2026-93937","cvss":9.8,"epss":0.0033,"slug":"cve-2026-93937-deserialization-of-untrusted-data-vulnerability-in-themerex-group","title":"ThemeREX Hygia PHP object injection vulnerability","severity":"critical","exploited":false,"published_at":"2026-10-10T08:17:06.187+00:00","url":"https://junglewise.ai/threats/cve-2026-93937-deserialization-of-untrusted-data-vulnerability-in-themerex-group"},{"cve":"CVE-2026-93936","cvss":9.8,"epss":0.0033,"slug":"cve-2026-93936-deserialization-of-untrusted-data-vulnerability-in-themerex-group","title":"ThemeREX Group IPharm PHP object injection","severity":"critical","exploited":false,"published_at":"2026-10-10T08:17:06.06+00:00","url":"https://junglewise.ai/threats/cve-2026-93936-deserialization-of-untrusted-data-vulnerability-in-themerex-group"},{"cve":"CVE-2026-93929","cvss":9.8,"epss":0.0032,"slug":"cve-2026-93929-deserialization-of-untrusted-data-vulnerability-in-themerex-group","title":"ThemeREX Group Travesia PHP object injection","severity":"critical","exploited":false,"published_at":"2026-10-10T08:17:05.183+00:00","url":"https://junglewise.ai/threats/cve-2026-93929-deserialization-of-untrusted-data-vulnerability-in-themerex-group"},{"cve":"CVE-2026-62046","cvss":9.8,"epss":0.0032,"slug":"cve-2026-62046-deserialization-of-untrusted-data-vulnerability-in-themerex-group","title":"ThemeREX Gutentype PHP object injection","severity":"critical","exploited":false,"published_at":"2026-10-10T08:17:04.777+00:00","url":"https://junglewise.ai/threats/cve-2026-62046-deserialization-of-untrusted-data-vulnerability-in-themerex-group"},{"cve":"CVE-2026-62045","cvss":9.8,"epss":0.0032,"slug":"cve-2026-62045-deserialization-of-untrusted-data-vulnerability-in-themerex-group","title":"ThemeREX Group Booklovers object injection through deserialization","severity":"critical","exploited":false,"published_at":"2026-10-10T08:17:04.647+00:00","url":"https://junglewise.ai/threats/cve-2026-62045-deserialization-of-untrusted-data-vulnerability-in-themerex-group"},{"cve":"CVE-2026-93944","cvss":9.8,"epss":0.0031,"slug":"cve-2026-93944-deserialization-of-untrusted-data-vulnerability-in-themerex-group","title":"ThemeREX Camelia PHP object injection","severity":"critical","exploited":false,"published_at":"2026-10-10T08:17:06.93+00:00","url":"https://junglewise.ai/threats/cve-2026-93944-deserialization-of-untrusted-data-vulnerability-in-themerex-group"}],"generated_at":"2026-11-10T03:07:00.198065+00:00","technologies":[]}