The ThemeREX Royal Event WordPress theme, versions up to and including 2.0 (lower bound unknown), deserializes untrusted data, which allows PHP Object Injection. An unauthenticated remote attacker can exploit this without user interaction, which may allow manipulation of server-side processing and, depending on the gadget chains available in the site's plugins, remote code execution or data compromise. CVSS 3.1 is 9.8 (Critical) per Patchstack; VulDB scores it 7.3. No exploitation in the wild is known at the time of writing.
ThemeREX · Royal Event
The Gunslinger WordPress theme up to and including version 1.11 is affected by an unauthenticated PHP Object Injection flaw (CWE-502) rated CVSS 9.8 critical. An unauthenticated remote attacker can supply crafted serialized data to the website, which may lead to code execution or manipulation of data on the server, depending on the classes available in installed plugins. The theme is typically used for online shops, so internet-facing sites are most at risk.
ThemeREX · Gunslinger
The Good Homes WordPress theme up to version 1.3.13 is vulnerable to PHP Object Injection through unsafe deserialization of data. An unauthenticated remote attacker can exploit this over the network by sending crafted input to a public website. Depending on the PHP classes available on the site, this can lead to manipulation of data or code execution on the server.
ThemeREX · Good Homes
The Gamic WordPress theme up to version 1.19 is vulnerable to PHP Object Injection (CWE-502), which can be triggered without authentication over the network. An attacker can manipulate how the site processes serialized data, which may allow harmful actions on the server. Whether this leads to code execution or data compromise depends on other installed plugins or themes that provide exploitable gadget chains; this is not established for the theme alone.
ThemeREX · Gamic WordPress Theme
The Gamezone WordPress theme by ThemeREX, up to and including version 1.1.11, contains an unauthenticated PHP object injection flaw (CWE-502). An attacker can send crafted data to the website without logging in, which can lead to harmful actions on the server, such as code execution, depending on the gadget classes available in the installation. At the time of writing, no fixed version or vendor advisory has been found, and the NVD status is Deferred.
ThemeREX · Gamezone WordPress theme
The WordPress theme EmojiNation up to and including version 1.0.12 contains a PHP Object Injection vulnerability (CWE-502). It can be triggered over the network without authentication. An attacker can manipulate how the site processes data, which may lead to harmful actions on the server. No fixed version has been confirmed, and NVD lists the status as Deferred.
ThemeREX · EmojiNation theme
The Edge Decor WordPress theme up to and including version 2.9 contains an unauthenticated PHP Object Injection vulnerability (CWE-502). A remote attacker can send crafted serialized data to a vulnerable site without logging in, which can be used to manipulate server-side processing. Whether this leads to code execution depends on the gadget chains available in the theme and other installed plugins.
ThemeREX · Edge Decor
The Coinpress WordPress theme up to and including version 1.0.15 contains a PHP Object Injection flaw (CWE-502) that can be triggered without authentication over the network. An attacker who can send crafted input to the affected site may manipulate how data is processed and potentially run harmful actions on the server. The NVD rates this CVSS 3.1 9.8 (Critical), while the VulDB score is 7.3 and Vulners lists 5.9, so the scores differ; plan using the higher value until the Patchstack advisory says otherwise.
ThemeREX · Coinpress
The WordPress theme Bonbon up to and including version 1.11 is affected by an unauthenticated PHP Object Injection vulnerability (CWE-502). An attacker can send crafted input to a public website without logging in, which can lead to manipulation of server-side processing and potentially to remote code execution. No official fix is known and no confirmed exploitation has been reported so far.
ThemeREX · Bonbon
The Avventure WordPress theme up to and including version 1.1.12 contains a PHP Object Injection vulnerability (CVE-2026-62010, CVSS 9.8 critical). An unauthenticated remote attacker can supply crafted serialized data to the site, which may lead to code execution, SQL injection, path traversal or denial of service, depending on the available gadget chains. The exposure applies to any internet-reachable WordPress site running the theme. No fixed version or vendor advisory was available at the time of research.
ThemeREX · Avventure
The Filmax WordPress theme up to and including version 1.1.11 contains a PHP Object Injection vulnerability (CWE-502) that can be exploited without authentication. An remote attacker can send crafted input to manipulate how the site processes serialized data, which may lead to harmful actions on the server. Whether this allows code execution depends on whether a usable gadget chain exists in the installed WordPress environment.
ThemeREX · Filmax
The WordPress theme Orpheus up to and including version 1.8 is affected by an unauthenticated PHP Object Injection vulnerability (CWE-502). An attacker on the network can send crafted data to the site without any account, which may allow manipulation of server-side processing and harmful actions on the server. NVD rates the issue as Critical (CVSS 3.1 9.8), while VulDB assigns 7.3; no vendor fix has been confirmed.
ThemeREX · Orpheus
The Nuts WordPress theme up to and including version 1.12 contains a PHP Object Injection flaw (CWE-502) that can be triggered without authentication over the network. An attacker who sends a crafted request can manipulate how the site processes data, which may lead to harmful actions on the server, including reading or changing data and disrupting the site. The theme is sold for gambling and casino websites; the vendor has not published a fix, and the vendor-to-product match is based on third-party data.
ThemeREX · Nuts
The Muzicon WordPress theme up to and including version 1.15 contains a PHP Object Injection flaw (CWE-502) that can be triggered without authentication over the network. An attacker who sends crafted serialized data to a vulnerable site may be able to manipulate how the application processes data and run harmful actions on the server. The actual impact depends on the gadget chains available in the installed plugins, which has not been assessed.
ThemeREX · Muzicon
The Motorix WordPress theme up to and including version 1.11 contains an unauthenticated PHP object injection flaw (CWE-502). An attacker can send crafted serialized data over the network without logging in, which may let them manipulate how the site processes data and run harmful actions on the server. Remote code execution is reported by a third-party aggregator but is not confirmed by the primary advisory, and whether it is exploitable depends on the code installed on each site.
ThemeREX · Motorix
The Mission WordPress theme up to version 1.22 contains an unauthenticated PHP Object Injection flaw (CWE-502). An attacker can send crafted data that the application unserializes, which can manipulate application logic and, depending on gadget chains available on the server, lead to code execution. Patchstack rates it CVSS 9.8 and high priority. Public websites are reachable from the internet by design, so exposure is high.
ThemeREX · Mission
The Meals & Wheels WordPress theme up to and including version 1.1.13 contains a PHP Object Injection weakness (CWE-502). An unauthenticated remote attacker can submit crafted serialized data, which may allow manipulation of how the site processes data and execution of harmful actions on the server. The CVSS score of 9.8 is a CNA score, as NVD enrichment is pending.
ThemeREX · Meals & Wheels
The Marcell WordPress theme up to and including version 1.2.14 is affected by an unauthenticated PHP Object Injection flaw (CWE-502). An unauthenticated remote attacker can send crafted data to the site, which may let them manipulate how the site processes data and potentially run harmful actions on the server. NVD rates the issue 9.8 (Critical), while VulDB rates it 7.3. No vendor patch has been confirmed, and no public exploit or known in-the-wild use was found.
ThemeREX · Marcell
The WordPress theme Le Truffe up to and including version 1.1.7 contains an unauthenticated PHP Object Injection flaw (CWE-502). An unauthenticated remote attacker can send crafted serialized data to the site, which may lead to code execution, file manipulation or denial of service, depending on the code available on the server. The CVSS base score is 9.8 (critical), and Patchstack expects mass exploitation.
ThemeREX · Le Truffe
The Legal Stone WordPress theme up to and including version 1.2.11 contains an unauthenticated PHP object injection vulnerability (CWE-502). An unauthenticated remote attacker can manipulate serialized data processed by the website, which may allow execution of harmful actions on the server. Patchstack rates the issue as critical (CVSS 9.8) and expects exploitation, but no fixed version or public exploit has been confirmed.
ThemeREX · Legal Stone
The Ozisti WordPress theme up to and including version 1.1.10 contains an unauthenticated PHP Object Injection vulnerability (CWE-502). An attacker can send crafted serialized data to the site, which can manipulate how the application processes data and potentially run harmful actions on the server. No login is required, and the NVD rates the issue as critical (CVSS 3.1 9.8), although other scoring sources differ.
ThemeREX · Ozisti
The Preservation WordPress theme up to and including version 1.15 contains an unauthenticated PHP object injection flaw (CWE-502). An unauthenticated remote attacker can supply crafted serialized data that the theme processes, which can manipulate application logic and may lead to further actions on the server. Whether code execution is possible depends on gadget chains available in other installed plugins or themes, which is not confirmed for this theme. The NVD score is 9.8 (Critical), but the NVD record is still in Deferred status.
ThemeREX · Preservation
The WordPress theme Printy up to and including version 1.13.0 contains a PHP Object Injection flaw (CWE-502) that can be triggered without authentication over the network. An attacker can manipulate serialized data processed by the site, which may lead to harmful actions on the server, depending on the installed plugins and code available for chaining. The vulnerability is rated critical with CVSS 9.8, and Patchstack expects exploitation in mass campaigns, although no exploitation has been confirmed so far.
ThemeREX · Printy
The Quirky WordPress theme in versions up to and including 1.23 contains a PHP Object Injection vulnerability (CWE-502). An unauthenticated remote attacker can send crafted serialized data to a public site, which may allow manipulation of server-side processing and, depending on the PHP classes available on the site, code execution or other serious impact. The CVSS base score is 9.8 (critical); the actual impact per site could not be verified.
ThemeREX · Quirky WordPress theme
The RexCoin WordPress theme up to and including version 1.2.6 contains an unauthenticated PHP object injection flaw (CWE-502). A remote attacker can send crafted data to a public website without logging in, which can let them manipulate server-side processing and potentially run harmful code. Patchstack rates the issue as high priority with a CVSS score of 9.8 and expects it to be exploited, while NVD status is currently Deferred.
ThemeREX · RexCoin WordPress theme
