CVE-2025-60205

Deserialization of Untrusted Data vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Object Injection.This issue affects ThemeREX Addons: from n/a through 2.36.1.1.

Score

CVSS 3.1 9.8 Critical

Status

Deferred - audit@patchstack.com

Published

2026-06-17

Last modified

2026-10-15

Weaknesses

CWE-502

Affected products

• Themerex Addons (Themerex Group)

References

• https://patchstack.com/database/wordpress/plugin/trx_addons/vulnerability/wordpress-themerex-addons-plugin-2-35-3-php-o…