# ThemeREX vulnerabilities Source: https://junglewise.ai/threats/vendors/themerex Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/themerex.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 66 vulnerabilities in ThemeREX: 0 in the last 7 days and 3 in the last 90 days, 8 of them critical and 0 exploited in the wild. The most recent, CVE-2026-119526, was published on 30 October 2026. 2 vulnerabilities in the last four weeks, up 100% on the four before (1). 2 critical against 0. ## Counts - Last 7 days: 0 - Last 30 days: 2 - Last 90 days: 3 - All time: 66 (8 critical, 0 exploited in the wild) ## About ThemeREX ThemeREX is a developer of themes and plugins for the WordPress content management system. ## Latest ThemeREX vulnerabilities - [CVE-2026-119526: ThemeREX Royal Event PHP object injection](https://junglewise.ai/threats/cve-2026-119526-deserialization-of-untrusted-data-vulnerability-in-themerex) (critical, CVSS 9.8, published 30 Oct 2026) - [CVE-2026-112847: ThemeREX ZenSoul PHP object injection vulnerability](https://junglewise.ai/threats/cve-2026-112847-deserialization-of-untrusted-data-vulnerability-in-themerex) (critical, CVSS 9.8, published 23 Oct 2026) - [CVE-2026-94063: ThemeREX Education Center reflected cross-site scripting](https://junglewise.ai/threats/cve-2026-94063-improper-neutralization-of-input-during-web-page-generation-cross) (high, CVSS 7.1, published 9 Oct 2026) - [CVE-2026-57747: ThemeREX Booked CSRF in WordPress plugin](https://junglewise.ai/threats/cve-2026-57747-themerex-booked-csrf-in-wordpress-plugin) (medium, CVSS 6.5, published 2 Jul 2026) - [CVE-2026-57746: ThemeREX Booked broken access control in WordPress plugin](https://junglewise.ai/threats/cve-2026-57746-themerex-booked-broken-access-control-in-wordpress-plugin) (high, CVSS 7.1, published 2 Jul 2026) - [CVE-2025-69175: ThemeREX Line Agency Local File Inclusion](https://junglewise.ai/threats/cve-2025-69175-themerex-line-agency-local-file-inclusion) (high, CVSS 8.1, published 17 Jun 2026) - [CVE-2025-69174: ThemeREX Etude Local File Inclusion](https://junglewise.ai/threats/cve-2025-69174-themerex-etude-local-file-inclusion) (high, CVSS 8.1, published 17 Jun 2026) - [CVE-2025-69170: ThemeREX Eventicity Local File Inclusion](https://junglewise.ai/threats/cve-2025-69170-themerex-eventicity-local-file-inclusion) (high, CVSS 8.1, published 17 Jun 2026) - [CVE-2025-69166: ThemeREX Gunslinger Local File Inclusion](https://junglewise.ai/threats/cve-2025-69166-themerex-gunslinger-local-file-inclusion) (high, CVSS 8.1, published 17 Jun 2026) - [CVE-2025-69164: ThemeREX Skyward unauthenticated local file inclusion](https://junglewise.ai/threats/cve-2025-69164-themerex-skyward-unauthenticated-local-file-inclusion) (high, CVSS 8.1, published 17 Jun 2026) - [CVE-2025-69158: ThemeREX Granola unauthenticated local file inclusion](https://junglewise.ai/threats/cve-2025-69158-themerex-granola-unauthenticated-local-file-inclusion) (high, CVSS 8.1, published 17 Jun 2026) - [CVE-2025-69157: ThemeREX Gamic Local File Inclusion](https://junglewise.ai/threats/cve-2025-69157-themerex-gamic-local-file-inclusion) (high, CVSS 8.1, published 17 Jun 2026) - [CVE-2025-69144: ThemeREX Preservation unauthenticated Local File Inclusion](https://junglewise.ai/threats/cve-2025-69144-themerex-preservation-unauthenticated-local-file-inclusion) (high, CVSS 8.1, published 17 Jun 2026) - [CVE-2025-69127: ThemeREX Plumbing PHP Object Injection](https://junglewise.ai/threats/cve-2025-69127-themerex-plumbing-php-object-injection) (critical, CVSS 9.8, published 17 Jun 2026) - [CVE-2025-69126: ThemeREX Fortius unauthenticated local file inclusion](https://junglewise.ai/threats/cve-2025-69126-themerex-fortius-unauthenticated-local-file-inclusion) (high, CVSS 8.1, published 17 Jun 2026) - [CVE-2025-69123: ThemeREX Snow Club Local File Inclusion](https://junglewise.ai/threats/cve-2025-69123-themerex-snow-club-local-file-inclusion) (high, CVSS 8.1, published 17 Jun 2026) - [CVE-2025-69120: ThemeREX Dazzle Local File Inclusion](https://junglewise.ai/threats/cve-2025-69120-themerex-dazzle-local-file-inclusion) (high, CVSS 8.1, published 17 Jun 2026) - [CVE-2025-69115: ThemeREX LuxMed Local File Inclusion](https://junglewise.ai/threats/cve-2025-69115-themerex-luxmed-local-file-inclusion) (high, CVSS 8.1, published 17 Jun 2026) - [CVE-2025-69111: ThemeREX Reisen PHP Object Injection](https://junglewise.ai/threats/cve-2025-69111-themerex-reisen-php-object-injection) (critical, CVSS 9.8, published 17 Jun 2026) - [CVE-2025-69106: ThemeREX Imba Local File Inclusion](https://junglewise.ai/threats/cve-2025-69106-themerex-imba-local-file-inclusion) (high, CVSS 8.1, published 17 Jun 2026) - [CVE-2026-39529: ThemeREX Group Elementra PHP object injection](https://junglewise.ai/threats/cve-2026-39529-themerex-group-elementra-php-object-injection) (critical, CVSS 9.8, published 17 Jun 2026) - [CVE-2026-22338: ThemeREX EcoBlue local file inclusion](https://junglewise.ai/threats/cve-2026-22338-themerex-ecoblue-local-file-inclusion) (high, CVSS 8.1, published 17 Jun 2026) - [CVE-2026-22331: ThemeREX AutoParts local file inclusion](https://junglewise.ai/threats/cve-2026-22331-themerex-autoparts-local-file-inclusion) (high, CVSS 8.1, published 17 Jun 2026) - [CVE-2025-69176: ThemeREX ITactics Local File Inclusion](https://junglewise.ai/threats/cve-2025-69176-themerex-itactics-local-file-inclusion) (high, CVSS 8.1, published 17 Jun 2026) - [CVE-2025-69173: ThemeREX Tipsy Local File Inclusion](https://junglewise.ai/threats/cve-2025-69173-themerex-tipsy-local-file-inclusion) (high, CVSS 8.1, published 17 Jun 2026) ## Most severe ThemeREX vulnerabilities - [CVE-2025-69122: ThemeREX SeaFood Company PHP object injection](https://junglewise.ai/threats/cve-2025-69122-themerex-seafood-company-php-object-injection) (critical, CVSS 9.8, published 17 Jun 2026) - [CVE-2025-69108: ThemeREX Hot Coffee PHP Object Injection](https://junglewise.ai/threats/cve-2025-69108-themerex-hot-coffee-php-object-injection) (critical, CVSS 9.8, published 17 Jun 2026) - [CVE-2026-39529: ThemeREX Group Elementra PHP object injection](https://junglewise.ai/threats/cve-2026-39529-themerex-group-elementra-php-object-injection) (critical, CVSS 9.8, published 17 Jun 2026) - [CVE-2025-69127: ThemeREX Plumbing PHP Object Injection](https://junglewise.ai/threats/cve-2025-69127-themerex-plumbing-php-object-injection) (critical, CVSS 9.8, published 17 Jun 2026) - [CVE-2025-69111: ThemeREX Reisen PHP Object Injection](https://junglewise.ai/threats/cve-2025-69111-themerex-reisen-php-object-injection) (critical, CVSS 9.8, published 17 Jun 2026) - [CVE-2026-119526: ThemeREX Royal Event PHP object injection](https://junglewise.ai/threats/cve-2026-119526-deserialization-of-untrusted-data-vulnerability-in-themerex) (critical, CVSS 9.8, published 30 Oct 2026) - [CVE-2026-112847: ThemeREX ZenSoul PHP object injection vulnerability](https://junglewise.ai/threats/cve-2026-112847-deserialization-of-untrusted-data-vulnerability-in-themerex) (critical, CVSS 9.8, published 23 Oct 2026) - [CVE-2025-60205: ThemeREX Addons PHP Object Injection](https://junglewise.ai/threats/cve-2025-60205-themerex-addons-php-object-injection) (critical, CVSS 9.8, published 17 Jun 2026) - [CVE-2025-69168: ThemeREX Spike Local File Inclusion in WordPress theme](https://junglewise.ai/threats/cve-2025-69168-themerex-spike-local-file-inclusion-in-wordpress-theme) (high, CVSS 8.1, published 17 Jun 2026) - [CVE-2025-69167: ThemeREX Eros Theme Local File Inclusion](https://junglewise.ai/threats/cve-2025-69167-themerex-eros-theme-local-file-inclusion) (high, CVSS 8.1, published 17 Jun 2026) ## Vulnerabilities per week 2 vulnerabilities in the last four weeks, up 100% on the four before (1). 2 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 1 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 1 | 1 | 0 | | 26 Oct 2026 | 1 | 1 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "ThemeREX vulnerabilities", https://junglewise.ai/threats/vendors/themerex, 9 November 2026.