AccessPress Themes Vulnerabilities and Affected Products
Explore source-attributed vulnerabilities associated with AccessPress Themes products.
Products
- Access Demo Importer (WordPress plugin)2 vulnerabilities
- Bingle2 vulnerabilities
- Bloger2 vulnerabilities
- Doko2 vulnerabilities
- Enlighten2 vulnerabilities
- FotoGraphy2 vulnerabilities
- ParallaxSome2 vulnerabilities
- Punte2 vulnerabilities
- Revolve2 vulnerabilities
- Ripple2 vulnerabilities
- ScrollMe2 vulnerabilities
- Social Auto Poster2 vulnerabilities
- StoreVilla2 vulnerabilities
- VMag2 vulnerabilities
- WP TFeed2 vulnerabilities
- Access Demo Importer1 vulnerability
- accessbuddy1 vulnerability
- Accesspress Basic1 vulnerability
- AccessPress Custom CSS1 vulnerability
- AccessPress Custom Post Type1 vulnerability
- AccessPress iFeeds1 vulnerability
- Accesspress Lite1 vulnerability
- Accesspress Mag1 vulnerability
- AccessPress Parallax1 vulnerability
- AccessPress Root1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2023-26532MEDIUM | WordPress Social Auto Poster Plugin <= 2.1.4 is vulnerable to Cross Site Request Forgery (CSRF)Cross-Site Request Forgery (CSRF) vulnerability in AccessPress Themes Social Auto Poster plugin <= 2.1.4 versions. CWE-352Nov 22, 2023 | CVSS5.4v3.1 | EPSS0.269% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-26518MEDIUM | WordPress WP TFeed Plugin <= 1.6.9 is vulnerable to Cross Site Request Forgery (CSRF)Cross-Site Request Forgery (CSRF) vulnerability in AccessPress Themes WP TFeed plugin <= 1.6.9 versions. CWE-352Nov 12, 2023 | CVSS5.4v3.1 | EPSS0.301% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-23975MEDIUM | WordPress Access Demo Importer plugin <= 1.0.7 - Cross-Site Request Forgery (CSRF) vulnerability leading to Arbitrary Plugin ActivationCross-Site Request Forgery (CSRF) in Access Demo Importer <= 1.0.7 on WordPress allows an attacker to activate any installed plugin. CWE-352Apr 18, 2022 | CVSS6.5v3.1 | EPSS0.474% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-23976HIGH | WordPress Access Demo Importer plugin <= 1.0.7 - Cross-Site Request Forgery (CSRF) vulnerability leading to Data Reset (Posts / Pages / Media)Cross-Site Request Forgery (CSRF) in Access Demo Importer <= 1.0.7 on WordPress allows an attacker to reset all data (posts / pages / media). CWE-352Apr 18, 2022 | CVSS8.1v3.1 | EPSS0.462% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-24867CRITICAL | Backdoored Plugins & Themes from AccessPress ThemesNumerous Plugins and Themes from the AccessPress Themes (aka Access Keys) vendor are backdoored due to their website being compromised. Only plugins and themes downloaded via the vendor website are affected, and those hosted on wordpress.org are not. However, all of them were updated or removed to avoid any confusion CWE-912Feb 21, 2022 | CVSS9.8v3.1 | EPSS18.9% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-39317HIGH | AccessPress Themes - Authenticated Malicious File UploadA WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check in the plugin_offline_installer_callback function found in the /demo-functions.php file or /welcome.php file of the affected products. The complete list of affected products and their versions are below: WordPress Plugin: AccessPress Demo Importer <=1.0.6 WordPress Themes: accesspress-basic <= 3.2.1… | CVSS8.8v3.1 | EPSS1.71% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |