PT-2025-2485 · Famethemes · Onepress

Name of the Vulnerable Software and Affected Versions: FameThemes OnePress versions prior to 2.3.7 Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For versions prior to 2.3.7, update to...

CVE-2024-38739

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in FameThemes OnePress allows Stored XSS.This issue affects OnePress: from n/a through 2.3.8...

CVE-2024-38739 WordPress OnePress theme <= 2.3.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in FameThemes OnePress allows Stored XSS.This issue affects OnePress: from n/a through 2.3.8...

CVE-2024-38739

CVE-2024-38739 affects the OnePress WordPress theme (versions up to 2.3.8). It is described as a Stored Cross-Site Scripting (XSS) vulnerability in input handling during web page generation. The connected documents confirm the issue but do not provide a patch version or remediation details; no ex...

CVE-2024-38739 WordPress OnePress theme <= 2.3.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in FameThemes OnePress allows Stored XSS.This issue affects OnePress: from n/a through 2.3.8...

WordPress OnePress theme <= 2.3.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Theme OnePress versions = 2.3.8...

WordPress OnePress Theme <= 2.3.8 is vulnerable to Cross Site Scripting (XSS)

Software OnePress Type Theme Vulnerable versions = 2.3.8 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-38739 Patch priority Low CVSS severity Low 5.1 Developer Claim ownership PSID 564500b58f70 Credits stealthcopter Required privilege Author Publishe...

WordPress OnePress theme <= 2.3.6 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Theme OnePress versions = 2.3.6...

WordPress OnePress Theme <= 2.3.6 is vulnerable to Cross Site Request Forgery (CSRF)

Software OnePress Type Theme Vulnerable versions = 2.3.6 Fixed in 2.3.7 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-37448 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID c9968969f7ad Credits Dhabaleshwar Das Required...

WordPress OnePress Social Locker plugin cross-site request forgery vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

CVE-2022-1608

The OnePress Social Locker WordPress plugin through 5.6.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2022-1608

The OnePress Social Locker WordPress plugin through 5.6.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2022-1608

The OnePress Social Locker WordPress plugin through 5.6.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2022-1608

The CVE-2022-1608 entry concerns the WordPress plugin OnePress Social Locker (versions up to 5.6.2). The connected sources confirm a CSRF protection missing when updating settings, enabling a logged-in attacker to alter settings via a CSRF attack. No explicit fixed version is provided in the docu...

WordPress plugin OnePress Social Locker 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

WordPress OnePress Social Locker plugin <= 5.6.2 - Arbitrary Settings Update via Cross-Site Request Forgery (CSRF) vulnerability

Arbitrary Settings Update via Cross-Site Request Forgery CSRF vulnerability discovered by Daniel Ruf in WordPress OnePress Social Locker plugin versions = 5.6.2. Solution Deactivate and delete. This plugin has been closed as of May 6, 2022 and is not available for download. This closure is...

OnePress Social Locker <= 5.6.2 - Arbitrary Settings Update via CSRF

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack PoC...

OnePress Social Locker <= 4.2.0 - Authenticated Reflected Cross-Site Scripting (XSS)

The OnePress Social Locker WordPress plugin was affected by an Authenticated Reflected Cross-Site Scripting XSS security vulnerability...