CVE-2025-60205
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
There is an unauthenticated PHP Object Injection vulnerability in ThemeREX Addons versions <= 2.36.1.1.
Risk Assessment
An attacker could exploit this vulnerability to perform unauthorized actions within the system, potentially leading to serious security breaches.
Recommendation
It is recommended to update to the latest version of ThemeREX Addons to mitigate this vulnerability.
Other vulnerabilities in ThemeREX Addons
See all- CVE-2026-102798Medium
A stored XSS vulnerability in ThemeREX Addons (trx_addons) by ThemeREX Group allows persistent injection of malicious scripts. Affects versions from n/a through 2.46.0.
- CVE-2026-102797Medium
The ThemeREX Addons plugin (up to and including version 2.46.0) is vulnerable to Server-Side Request Forgery (SSRF). This allows an attacker to force the server to make requests to resources it should not normally access.
- CVE-2026-97236Medium
Cross Site Scripting (XSS) vulnerability in ThemeREX Addons before version 2.45.0. A subscriber can inject malicious scripts.
- CVE-2026-97235High
Unauthenticated XSS attack in ThemeREX Addons plugin versions prior to 2.45.0. An attacker can inject malicious script without authentication.
- CVE-2026-62105Critical
Unauthenticated PHP Object Injection in ThemeREX Addons versions below 2.45.0.
Original NVD description (English source)
Unauthenticated PHP Object Injection in ThemeREX Addons <= 2.36.1.1 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS