How many CVEs does ThemeREX addons have?

ThemeREX addons has 4 published CVE records since 2020.

How many ThemeREX addons CVEs are in CISA KEV?

None of ThemeREX addons's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Are there public exploits for ThemeREX addons vulnerabilities?

Yes — 1 of ThemeREX addons's CVEs have a known public exploit.

Which versions of ThemeREX addons are affected?

45 distinct ThemeREX addons versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in ThemeREX addons CVEs?

ThemeREX addons's CVEs most often map to these CWE weakness types: CWE-434 (Unrestricted Upload of File with Dangerous Type), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')).

How many critical ThemeREX addons vulnerabilities are there?

ThemeREX addons has 2 critical and 1 high-severity CVEs.

What is the average severity of ThemeREX addons CVEs?

The average CVSS base score across ThemeREX addons's scored CVEs is 8.7.

ThemeREX addons Vulnerabilities: CVEs, CISA KEV & Security Advisories

Affected versions and CVEs

Browse every ThemeREX addons version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges

< 2.34.02 CVEs
< 2.35.2.21 CVE
1.0.49.10 <= v <= 1.0.49.101 CVE
1.6.49.5 <= v <= 1.6.49.51 CVE
1.6.49.6 <= v <= 1.6.49.61 CVE
1.6.49.6.2 <= v <= 1.6.49.6.21 CVE
1.6.49.8 <= v <= 1.6.49.81 CVE
1.6.50 <= v <= 1.6.501 CVE
1.6.50.1 <= v <= 1.6.50.11 CVE
1.6.51.1 <= v <= 1.6.51.11 CVE
1.6.51.3 <= v <= 1.6.51.31 CVE
1.6.52.1 <= v <= 1.6.52.11 CVE
1.6.52.2 <= v <= 1.6.52.21 CVE
1.6.53 <= v <= 1.6.531 CVE
1.6.53.1 <= v <= 1.6.53.11 CVE
1.6.53.2 <= v <= 1.6.53.21 CVE
1.6.53.3 <= v <= 1.6.53.31 CVE
1.6.54 <= v <= 1.6.541 CVE
1.6.55.1 <= v <= 1.6.55.11 CVE
1.6.55.3 <= v <= 1.6.55.31 CVE
1.6.55.4 <= v <= 1.6.55.41 CVE
1.6.55.7 <= v <= 1.6.55.71 CVE
1.6.56 <= v <= 1.6.561 CVE
1.6.57 <= v <= 1.6.571 CVE
1.6.57.2 <= v <= 1.6.57.21 CVE
1.6.57.3 <= v <= 1.6.57.31 CVE
1.6.57.4 <= v <= 1.6.57.41 CVE
1.6.58.2 <= v <= 1.6.58.21 CVE
1.6.59 <= v <= 1.6.591 CVE
1.6.59.1.1 <= v <= 1.6.59.1.11 CVE
1.6.59.2 <= v <= 1.6.59.21 CVE
1.6.59.3 <= v <= 1.6.59.31 CVE
1.6.60 <= v <= 1.6.601 CVE
1.6.61 <= v <= 1.6.611 CVE
1.6.61.1 <= v <= 1.6.61.11 CVE
1.6.61.2 <= v <= 1.6.61.21 CVE
1.6.61.3 <= v <= 1.6.61.31 CVE
1.6.62.1 <= v <= 1.6.62.11 CVE
1.6.62.3 <= v <= 1.6.62.31 CVE
1.6.65 <= v <= 1.6.651 CVE
1.6.66 <= v <= 1.6.661 CVE
1.6.67 <= v <= 1.6.671 CVE
1.70.3 <= v <= 1.70.31 CVE

Fixed in

2.34.02 CVEs
2.35.2.21 CVE

Find a version

4 CVEs

Sort

ThemeREX Addons <= 2.35.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via trx_addons_get_svg_from_file Function
CVE-2025-6997
Patch
CWE-79
Medium · CVSS 6.4
EPSS 0.2% (11th pct)2025-07-19
ThemeREX Addons <= 2.32.3 - Unauthenticated Arbitrary File Upload in trx_addons_uploads_save_data
CVE-2024-13448
Patch
CWE-434
Critical · CVSS 9.8
EPSS 0.9% (55th pct)2025-01-28
ThemeREX Addons <= 2.33.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode
CVE-2025-0682
Patch
CWE-98
High · CVSS 8.8
EPSS 0.6% (45th pct)2025-01-25
Critical vulnerability · 2020-03-09
CVE-2020-10257
Public exploit
Patch
Critical · CVSS 9.8
EPSS 8.9% (95th pct)2020-03-09

ThemeREX addons Vulnerabilities

Overview

Severity and exploitation

Affected versions and CVEs

Version ranges

Fixed in

Common weakness types

Disclosure activity by year

Other ThemeREX products

Frequently asked questions

References

Track ThemeREX addons vulnerabilities