Vulnerability Database

309,130

Total vulnerabilities in the database

CVE-2020-10257

The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe sc parameter.

  • Published: Mar 10, 2020
  • Updated: Nov 9, 2025
  • CVE: CVE-2020-10257
  • Severity: Critical
  • Exploit:

CVSS v3:

  • Severity: Critical
  • Score: 9.8
  • AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2:

  • Severity: High
  • Score: 7.5
  • AV:N/AC:L/Au:N/C:P/I:P/A:P

CWEs:

Software From Fixed in
themerex / addons 1.70.3 1.70.3.x
themerex / ozeum-museum - 1.0.2
themerex / chit_club-board_games - 1.0.1
themerex / addons 1.6.67 1.6.67.x
themerex / yottis-simple_portfolio - 1.0.1
themerex / addons 1.6.66 1.6.66.x
themerex / helion-agency_&portfolio - 1.0.3
themerex / amuli - 1.0.2
themerex / addons 1.6.65 1.6.65.x
themerex / nelson-barbershop_+_tattoo_salon - 1.0.1.2001
themerex / hallelujah-church - 1.0.1
themerex / right_way - 4.0.1
themerex / prider-pride_fest - 1.0.2
themerex / addons 1.6.62.3 1.6.62.3.x
themerex / mystik-esoterics - 1.0.1
themerex / skydiving_and_flying_company - 1.0.1
themerex / addons 1.6.62.1 1.6.62.1.x
themerex / dronex-aerial_photography_services - 1.1.2001
themerex / addons 1.6.61.2 1.6.61.2.x
themerex / samadhi-buddhist - 1.0.1
themerex / addons 1.6.61.3 1.6.61.3.x
themerex / tantum-rent_a_car,_rent_a_bike,_rent_a_scooter_multiskin_theme - 1.0.2
themerex / scientia-public_library - 1.0.1
themerex / blabber - 1.5.2009
themerex / addons 1.6.61.1 1.6.61.1.x
themerex / impacto_patronus_multi-landing - 1.1.2001
themerex / addons 1.6.61 1.6.61.x
themerex / rare_radio - 1.0.1
themerex / addons 1.6.60 1.6.60.x
themerex / piqes-creative_startup_&_agency_wordpress_theme - 1.0.1
themerex / addons 1.6.59.3 1.6.59.3.x
themerex / kratz-digital_agency - 1.0.2
themerex / addons 1.6.59.2 1.6.59.2.x
themerex / pixefy - 1.0.1
themerex / addons 1.6.59.1.1 1.6.59.1.1.x
themerex / netmix-broadband_&_telecom - 1.0.2
themerex / addons 1.6.59 1.6.59.x
themerex / kids_care - 3.0.5
themerex / addons 1.6.58.2 1.6.58.2.x
themerex / briny-diving_wordpress_theme - 1.2.2000
themerex / addons 1.6.57.3 1.6.57.3.x
themerex / tornados - 1.1.2001
themerex / addons 1.6.57.4 1.6.57.4.x
themerex / gridiron - 1.0.2
themerex / addons 1.6.57.2 1.6.57.2.x
themerex / yungen-digital/marketing_agency - 1.0.1
themerex / fc_united-football - 1.0.7
themerex / bugster-pests_control - 1.0.2
themerex / addons 1.6.57 1.6.57.x
themerex / rumble-single_fighter_boxer,_news,_gym,_store - 1.0.4
themerex / addons 1.6.56 1.6.56.x
themerex / tacticool-shooting_range_wordpress_theme - 1.0.1
themerex / addons 1.6.55.4 1.6.55.4.x
themerex / coinpress-cryptocurrency_magazine_&_blog_wordpress_theme - 1.0.2
themerex / addons 1.6.55.7 1.6.55.7.x
themerex / vihara-ashram,_buddhist - 1.1.2001
themerex / addons 1.6.55.3 1.6.55.3.x
themerex / katelyn-gutenberg_wordpress_blog_theme - 1.0.4
themerex / addons 1.6.55.1 1.6.55.1.x
themerex / heaven_11-multiskin_property_theme - 1.0.2
themerex / addons 1.6.54 1.6.54.x
themerex / especio-food_gutenberg_theme - 1.0.1
themerex / addons 1.6.53.1 1.6.53.1.x
themerex / partiso_electioncampaign - 1.1.2002
themerex / addons 1.6.53.3 1.6.53.3.x
themerex / kargo-freight_transport - 1.1.2004
themerex / addons 1.6.53.2 1.6.53.2.x
themerex / maxify-startup_blog - 1.0.4
themerex / lingvico-language_learning_school - 1.0.3
themerex / aldo-gutenberg_wordpress_blog_theme - 1.0.2
themerex / addons 1.6.52.2 1.6.52.2.x
themerex / vixus-startup_/_mobile_application - 1.0.4
themerex / addons 1.6.52.1 1.6.52.1.x
themerex / wellspring_water_filter_systems - 1.0.3
themerex / nazareth-church - 1.0.5
themerex / addons 1.6.53 1.6.53.x
themerex / tediss-soft_play_area,_cafe_&_child_care_center - 1.0.3
themerex / addons 1.6.51.3 1.6.51.3.x
themerex / yolox-startup_magazine_&_blog_wordpress_theme - 1.0.3
themerex / meals_and_wheels-food_truck - 1.0.3
themerex / addons 1.6.51.1 1.6.51.1.x
themerex / rosalinda-vegetarian_&_health_coach - 1.0.3
themerex / addons 1.6.50 1.6.50.x
themerex / vapester - 1.1.2001
themerex / modern_housewife-housewife_and_family_blog - 1.0.2
themerex / addons 1.6.50.1 1.6.50.1.x
themerex / chainpress - 1.0.3
themerex / justitia-multiskin_lawyer_theme - 1.0.3
themerex / hobo_digital_nomad_blog - 1.0.3
themerex / rhodos-creative_corporate_wordpress_theme - 1.3.2001
themerex / buzz_stone-magazine_&_blog - 1.0.3
themerex / addons 1.0.49.10 1.0.49.10.x
themerex / corredo_sport_event - 1.1.2003
themerex / addons 1.6.49.8 1.6.49.8.x
themerex / savejulia_personal_fundraising_campaign - 1.0.3
themerex / addons 1.6.49.6 1.6.49.6.x
themerex / bonkozoo_zoo - 1.0.3
themerex / addons 1.6.49.6.2 1.6.49.6.2.x
themerex / renewal-plastic_surgeon_clinic - 1.0.3
themerex / addons 1.6.49.5 1.6.49.5.x
themerex / gloss_blog - 1.0.1
themerex / plumbing-repair,_building_&_construction_wordpress_theme - 3.0.1