ThemeREX Addons vulnerabilities

A stored XSS vulnerability in ThemeREX Addons (trx_addons) by ThemeREX Group allows persistent injection of malicious scripts. Affects versions from n/a through 2.46.0.

The ThemeREX Addons plugin (up to and including version 2.46.0) is vulnerable to Server-Side Request Forgery (SSRF). This allows an attacker to force the server to make requests to resources it should not normally access.

Cross Site Scripting (XSS) vulnerability in ThemeREX Addons before version 2.45.0. A subscriber can inject malicious scripts.

Unauthenticated XSS attack in ThemeREX Addons plugin versions prior to 2.45.0. An attacker can inject malicious script without authentication.

Unauthenticated PHP Object Injection in ThemeREX Addons versions below 2.45.0.

The ThemeREX Addons plugin (up to 2.36.1.1) contains a deserialization of untrusted data vulnerability that allows object injection. An attacker could exploit this flaw to execute malicious code within the WordPress application context.