GCVE - cpe:2.3:a:famethemes:onepress:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:famethemes:onepress:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Famethemes (`a833614b-29e7-5388-b77e-70f01ce490eb`)
Product	Onepress (`3dd8d3f3-e0c0-5d7a-a4fc-ac4f90f6833c`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-5092`	vulnerable	2026-06-08 07:35:24.142299	Multiple Plugins and Themes <= (Various Versions) - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via lightGallery JavaScript Library MEDIUM (6.4) Multiple plugins and/or themes for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled lightGallery library (<= 2.8.3) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Published: 2025-11-20T06:38:41.693Z Updated: 2026-04-08T17:14:57.172Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/acaa3142-2bbc-43d3-8ecc-05e8edb931ec?source=cve https://github.com/sachinchoolur/lightGallery https://plugins.trac.wordpress.org/changeset/3311382/ https://plugins.trac.wordpress.org/changeset/3356089/ https://plugins.trac.wordpress.org/changeset/3372141/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-22643`	vulnerable	2026-06-08 07:10:54.561370	WordPress OnePress theme <= 2.3.11 - Broken Access Control vulnerability MEDIUM (4.3) Missing Authorization vulnerability in famethemes OnePress onepress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects OnePress: from n/a through <= 2.3.11. Published: 2025-02-04T14:21:57.321Z Updated: 2026-04-28T16:11:02.922Z Open on db.gcve.eu Reference links https://patchstack.com/database/Wordpress/Theme/onepress/vulnerability/wordpress-onepress-theme-2-3-11-broken-access-control-vulnerability?_s_id=cve	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-38739`	vulnerable	2026-06-08 06:41:48.031521	WordPress OnePress theme <= 2.3.8 - Cross Site Scripting (XSS) vulnerability MEDIUM (5.1) Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in FameThemes OnePress allows Stored XSS.This issue affects OnePress: from n/a through 2.3.8. Published: 2024-07-20T07:16:23.137Z Updated: 2026-04-28T16:10:05.742Z Open on db.gcve.eu Reference links https://patchstack.com/database/vulnerability/onepress/wordpress-onepress-theme-2-3-8-cross-site-scripting-xss-vulnerability?_s_id=cve	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-37448`	vulnerable	2026-06-08 06:39:47.596434	WordPress OnePress theme <= 2.3.6 - Cross Site Request Forgery (CSRF) vulnerability MEDIUM (4.3) Cross-Site Request Forgery (CSRF) vulnerability in famethemes OnePress onepress allows Cross Site Request Forgery.This issue affects OnePress: from n/a through <= 2.3.6. Published: 2025-01-02T12:00:52.057Z Updated: 2026-04-28T16:09:59.028Z Open on db.gcve.eu Reference links https://patchstack.com/database/Wordpress/Theme/onepress/vulnerability/wordpress-onepress-theme-2-3-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.