Accesspressthemes
19 CVEs across 126 Accesspressthemes products. Browse Accesspressthemes vulnerabilities, severities, and proof-of-concept exploits.
Accesspressthemes products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-47910 | Medium | 6.4 | 2026-05-10 | AccessPress Social Icons 1.8.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by entering… |
CVE-2023-26532 | Medium | 5.4 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in AccessPress Themes Social Auto Poster plugin <= 2.1.4 versions. |
CVE-2023-26518 | Medium | 5.4 | 2023-11-13 | Cross-Site Request Forgery (CSRF) vulnerability in AccessPress Themes WP TFeed plugin <= 1.6.9 versions. |
CVE-2022-4946 | Medium | 5.4 | 2023-06-05 | The Frontend Post WordPress Plugin WordPress plugin through 2.8.4 does not validate an attribute of one of its shortcode, which could allow users with a role a… |
CVE-2023-28661 | High | 8.8 | 2023-03-22 | The WP Popup Banners WordPress Plugin, version <= 1.2.5, is affected by an authenticated SQL injection vulnerability in the 'value' parameter in the get_popup_… |
CVE-2023-0175 | Medium | 5.4 | 2023-03-20 | The Responsive Clients Logo Gallery Plugin for WordPress plugin through 1.1.9 does not validate and escape some of its shortcode attributes before outputting t… |
CVE-2022-23976 | High | 8.1 | 2022-04-18 | Cross-Site Request Forgery (CSRF) in Access Demo Importer <= 1.0.7 on WordPress allows an attacker to reset all data (posts / pages / media). |
CVE-2022-23975 | Medium | 6.5 | 2022-04-18 | Cross-Site Request Forgery (CSRF) in Access Demo Importer <= 1.0.7 on WordPress allows an attacker to activate any installed plugin. |
CVE-2022-0628 | Medium | 6.1 | 2022-03-21 | The Mega Menu WordPress plugin before 3.0.8 does not sanitize and escape the _wpnonce parameter before outputting it back in an admin page, leading to a Reflec… |
CVE-2022-23912 | Medium | 6.1 | 2022-02-28 | The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not sanitise and escape the id parameter before outputting it back in an attribute, leading… |
CVE-2022-23911 | High | 7.2 | 2022-02-28 | The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not validate and escape the id parameter before using it in a SQL statement when retrieving… |
CVE-2021-24867 | Critical | 9.8 | 2022-02-21 | Numerous Plugins and Themes from the AccessPress Themes (aka Access Keys) vendor are backdoored due to their website being compromised. Only plugins and themes… |
CVE-2021-25107 | Medium | 6.1 | 2022-02-14 | The Form Store to DB WordPress plugin before 1.1.1 does not sanitise and escape parameter keys before outputting it back in the created entry, allowing unauthe… |
CVE-2021-24858 | High | 7.2 | 2022-01-24 | The Cookie Notification Plugin for WordPress plugin before 1.0.9 does not sanitise or escape the id GET parameter before using it in a SQL statement, when retr… |
CVE-2021-39317 | High | 8.8 | 2021-10-11 | A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX… |
CVE-2021-24143 | High | 8.8 | 2021-03-18 | Unvalidated input in the AccessPress Social Icons plugin, versions before 1.8.1, did not sanitise its widget attribute, allowing accounts with post permission… |
CVE-2020-25378 | Medium | 6.1 | 2020-09-14 | Wordpress Plugin Store / AccessPress Themes WP Floating Menu V1.3.0 is affected by: Cross Site Scripting (XSS) via the id GET parameter. |
CVE-2017-16949 | Critical | 9.8 | 2017-12-19 | An issue was discovered in the AccessKeys AccessPress Anonymous Post Pro plugin through 3.1.9 for WordPress. Improper input sanitization allows the attacker to… |
CVE-2017-15919 | Critical | 9.8 | 2017-10-26 | The ultimate-form-builder-lite plugin before 1.3.7 for WordPress has SQL Injection, with resultant PHP Object Injection, via wp-admin/admin-ajax.php. |