Filtered by vendor Themerex Subscriptions
Total 122 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-0682 1 Themerex 1 Addons 2026-04-08 8.8 High
The ThemeREX Addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.33.0 via the 'trx_sc_reviews' shortcode 'type' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.
CVE-2020-10257 1 Themerex 63 Addons, Aldo-gutenberg Wordpress Blog Theme, Amuli and 60 more 2024-11-21 9.8 Critical
The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe sc parameter.