AccessPress Themes vulnerabilities

Products

• Access Demo Importer (WordPress plugin) 2
• Bingle 2
• Bloger 2
• Doko 2
• Enlighten 2
• FotoGraphy 2
• ParallaxSome 2
• Punte 2
• Revolve 2
• Ripple 2
• ScrollMe 2
• Social Auto Poster 2
• StoreVilla 2
• VMag 2
• WP TFeed 2
• Access Demo Importer 1
• accessbuddy 1
• Accesspress Basic 1
• AccessPress Custom CSS 1
• AccessPress Custom Post Type 1
• AccessPress iFeeds 1
• Accesspress Lite 1
• Accesspress Mag 1
• AccessPress Parallax 1
• AccessPress Root 1
• AccessPress Social Counter 1
• AccessPress Social Icons 1
• AccessPress Social Login Lite – Social Login WordPress Plugin 1
• AccessPress Social Share 1
• AccessPress Staple 1

Latest AccessPress Themes CVEs

Newest publication first

1. CVE-2023-26532 WordPress Social Auto Poster Plugin <= 2.1.4 is vulnerable to Cross Site Request Forgery (CSRF)

   Published 2023-11-22

   High·CVSS 8.8 EPSS 0.27%

   Cross-Site Request Forgery (CSRF) vulnerability in AccessPress Themes Social Auto Poster plugin <= 2.1.4 versions.

2. CVE-2023-26518 WordPress WP TFeed Plugin <= 1.6.9 is vulnerable to Cross Site Request Forgery (CSRF)

   Published 2023-11-12

   High·CVSS 8.8 EPSS 0.30%

   Cross-Site Request Forgery (CSRF) vulnerability in AccessPress Themes WP TFeed plugin <= 1.6.9 versions.

3. CVE-2022-23976 WordPress Access Demo Importer plugin <= 1.0.7 - Cross-Site Request Forgery (CSRF) vulnerability leading to Data Reset (Posts / Pages / Media)

   Published 2022-04-18

   High·CVSS 8.1 EPSS 0.48%

   Cross-Site Request Forgery (CSRF) in Access Demo Importer <= 1.0.7 on WordPress allows an attacker to reset all data (posts / pages / media).

4. CVE-2022-23975 WordPress Access Demo Importer plugin <= 1.0.7 - Cross-Site Request Forgery (CSRF) vulnerability leading to Arbitrary Plugin Activation

   Published 2022-04-18

   Medium·CVSS 6.5 EPSS 0.49%

   Cross-Site Request Forgery (CSRF) in Access Demo Importer <= 1.0.7 on WordPress allows an attacker to activate any installed plugin.

5. CVE-2021-24867 Backdoored Plugins & Themes from AccessPress Themes

   Published 2022-02-21

   Critical·CVSS 9.8 EPSS 18.0%

   Numerous Plugins and Themes from the AccessPress Themes (aka Access Keys) vendor are backdoored due to their website being compromised. Only plugins and themes downloaded via the vendor website are affected, and those hosted on wordpress.org are not. However, all of them were upd...

6. CVE-2021-39317 AccessPress Themes - Authenticated Malicious File Upload

   Published 2021-10-11

   High·CVSS 8.8 EPSS 1.7%

   A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check in the plugin_offline_installer_callback function found in the /demo-functions.p...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.