Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · trx_addons
trx_addons
11 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 2, 2026ThemeREX Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-102798 · affects up to 2.46.0 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Stored XSS.This issue affects ThemeREX Addons: from n/a through 2.46.0.
Oct 2, 2026ThemeREX Addons: Server-Side Request Forgery (SSRF)CVE-2026-102797 · affects up to 2.46.0 · reported by PatchstackMedium 6.4
Server-Side Request Forgery (SSRF) vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Server Side Request Forgery.This issue affects ThemeREX Addons: from n/a through 2.46.0.
Sep 30, 2026Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.CVE-2026-97236 · reported by PatchstackMedium 6.5
Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.CVE-2026-97235 · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.
Sep 11, 2026Unauthenticated PHP Object Injection in ThemeREX Addons < 2.45.0 versions.CVE-2026-62105 · reported by PatchstackCritical 9.8
Unauthenticated PHP Object Injection in ThemeREX Addons < 2.45.0 versions.
Jun 17, 2026ThemeREX Addons: Deserialization of Untrusted DataCVE-2025-60205 · affects up to 2.36.1.1 · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Object Injection.This issue affects ThemeREX Addons: from n/a through 2.36.1.1.
Mar 23, 2026trx_addons: Does not correctly validate file types in one of its AJAX actionCVE-2026-1969 · fixed in 2.38.5 · reported by WPScanMedium 5.3
The trx_addons WordPress plugin before 2.38.5 does not correctly validate file types in one of its AJAX action, allowing unauthenticated users to upload arbitrary file. This is due to an incorrect fix of CVE-2024-13448
Jul 19, 2025ThemeREX Addons: Stored Cross-Site ScriptingCVE-2025-6997 · affects up to 2.35.1.1 · reported by WordfenceMedium 6.4
The ThemeREX Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.35.1.1 due to insufficient input sanitization and output escaping. The plugin’s SVG rendering routine calls the trx_addons_get_svg_from_file() function on an unvalidated 'svg' parameter supplied via the shortcode or Elementor widget settings, then outputs it via the trx_addons_show_layout() function. Because there is no check on the URL’s origin, scheme, or the SVG content itself, authenticated attackers, with Contributor-level access and above, can supply a remote SVG and inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Jan 28, 2025ThemeREX Addons: Arbitrary file uploadsCVE-2024-13448 · affects up to 2.32.3 · reported by WordfenceCritical 9.8
The ThemeREX Addons plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'trx_addons_uploads_save_data' function in all versions up to, and including, 2.32.3. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Jan 25, 2025ThemeREX Addons: Local File InclusionCVE-2025-0682 · affects up to 2.33.0 · reported by WordfenceHigh 8.8
The ThemeREX Addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.33.0 via the 'trx_sc_reviews' shortcode 'type' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.
Mar 9, 2020The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functionCVE-2020-10257 · fixed in 2020-03-09 · reported by MITRECritical 9.8
The ThemeREX Addons plugin before 2020-03-09 for WordPress lacks access control on the /trx_addons/v2/get/sc_layout REST API endpoint, allowing for PHP functions to be executed by any users, because includes/plugin.rest-api.php calls trx_addons_rest_get_sc_layout with an unsafe sc parameter.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.