Skip to content
Founder-led WordPress incident response and care Request an assessment
3zerodigital Request a Website Assessment

WordPress security records

WordPress Vulnerability Listing

Filter Production Feed records and inspect affected software, version ranges, severity, patch information and source attribution without opening separate UUID pages.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

Clear filters

4 vulnerability records

CriticalCVE-2025-39387

Opstore <= 1.4.5 - Unauthenticated Local File Inclusion

Opstore: Currently marked unpatched

Affected versions: *-1.4.5

Vulnerability type: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

Affected software, patched versions and attribution

The Opstore theme for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.4.5. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

Opstore

Affected versions: *-1.4.5

Patched versions: Not supplied

Researcher credit: Dimas Maulana

Applicable copyright and licence notices

This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

Licence reference

This record contains material that is subject to copyright

Copyright 1999-2026 The MITRE Corporation

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

Licence reference

Original Wordfence record
Published
April 21, 2025
CVSS
9.8
High

AccessPress Themes and Plugin <= Various Versions - Cross-Site Request Forgery

The Monday: Currently marked unpatchedDoko: Currently marked unpatchedEight Sec: Currently marked unpatchedRevolve: Currently marked unpatchedBingle: Currently marked unpatchedParallaxSome: Currently marked unpatchedUncode Lite: Currently marked unpatchedEightLaw Lite: Currently marked unpatchedAccessPress Lite: Currently marked unpatchedFotoGraphy: Currently marked unpatchedArrival: Currently marked unpatchedVMag: Currently marked unpatchedAccessPress Mag: Currently marked unpatchedSakala: Currently marked unpatchedVMagazine Lite: Currently marked unpatchedDigital Agency Lite: Currently marked unpatchedThe Launcher: Currently marked unpatchedZigcy Lite: Currently marked unpatchedBrovy: Currently marked unpatchedEightmedi Lite: Currently marked unpatchedWPparallax: Currently marked unpatchedEnlighten: Currently marked unpatchedEightStore Lite: Currently marked unpatchedAccessPress Store: Currently marked unpatchedSwing Lite: Currently marked unpatchedRipple: Currently marked unpatchedAccess Demo Importer: Currently marked unpatchedPunte: Currently marked unpatchedAccesspress Basic: Currently marked unpatchedZigcy Baby: Currently marked unpatchedScrollMe: Currently marked unpatchedZigcy Cosmetics: Currently marked unpatchedConstruction Lite: Currently marked unpatchedVmagazine News: Currently marked unpatchedAccessPress Parallax: Currently marked unpatchedAccessPress Root: Currently marked unpatchedAccessPress Staple: Currently marked unpatchedStoreVilla: Currently marked unpatchedUltra Seven: Currently marked unpatchedThe100: Currently marked unpatchedEdict Lite: Currently marked unpatchedWP Store: Currently marked unpatchedOpstore: Currently marked unpatchedBloger: Currently marked unpatched

Affected versions: *-1.4.1; *-1.0.27; *-1.1.4; *-1.3.1; *-1.0.4; *-1.3.6; *-1.3.3; *-2.1.5

Vulnerability type: CWE-352 Cross-Site Request Forgery (CSRF)

Affected software, patched versions and attribution

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to cross-site request forgery via the plugin_activation_callback and plugin_deactivate_callback functions, called via AJAX actions, that were missing capability checks and nonce validation. This makes it possible for unauthenticated attackers to deactivate and activate arbitrary plugins, granted they could trick a site administrator into performing an action such as clicking a link. This could be used to deactivate security plugins and exploit other potential vulnerabilities.

The Monday

Affected versions: *-1.4.1

Patched versions: Not supplied

Doko

Affected versions: *-1.0.27

Patched versions: 1.1.0

Eight Sec

Affected versions: *-1.1.4

Patched versions: Not supplied

Revolve

Affected versions: *-1.3.1

Patched versions: Not supplied

Bingle

Affected versions: *-1.0.4

Patched versions: 1.0.5

ParallaxSome

Affected versions: *-1.3.6

Patched versions: 1.3.7

Uncode Lite

Affected versions: *-1.3.3

Patched versions: Not supplied

EightLaw Lite

Affected versions: *-2.1.5

Patched versions: 2.1.6

AccessPress Lite

Affected versions: *-2.92

Patched versions: 2.93

FotoGraphy

Affected versions: *-2.4.0

Patched versions: 2.4.1

Arrival

Affected versions: *-1.4.2

Patched versions: 1.4.3

VMag

Affected versions: *-1.2.7

Patched versions: 1.2.8

AccessPress Mag

Affected versions: *-2.6.5

Patched versions: 2.6.6

Sakala

Affected versions: *-1.0.4

Patched versions: 1.0.5

VMagazine Lite

Affected versions: *-1.3.5

Patched versions: 1.3.6

Digital Agency Lite

Affected versions: *-1.1.6

Patched versions: 1.1.7

The Launcher

Affected versions: *-1.3.2

Patched versions: 1.3.3

Zigcy Lite

Affected versions: *-2.0.9

Patched versions: 2.1.0

Brovy

Affected versions: *-1.3

Patched versions: Not supplied

Eightmedi Lite

Affected versions: *-2.1.8

Patched versions: 2.1.9

WPparallax

Affected versions: *-2.0.6

Patched versions: Not supplied

Enlighten

Affected versions: *-1.3.5

Patched versions: 1.3.6

EightStore Lite

Affected versions: *-1.2.5

Patched versions: 1.2.6

AccessPress Store

Affected versions: *-2.4.9

Patched versions: 2.5.0

Swing Lite

Affected versions: *-1.1.9

Patched versions: 1.2.0

Ripple

Affected versions: *-1.2.1

Patched versions: Not supplied

Access Demo Importer

Affected versions: *-1.0.6

Patched versions: 1.0.7

Punte

Affected versions: *-1.1.2

Patched versions: 1.1.3

Accesspress Basic

Affected versions: *-3.2.1

Patched versions: 3.2.2

Zigcy Baby

Affected versions: *-1.0.6

Patched versions: 1.0.7

ScrollMe

Affected versions: *-2.1.0

Patched versions: Not supplied

Zigcy Cosmetics

Affected versions: *-1.0.5

Patched versions: 1.0.6

Construction Lite

Affected versions: *-1.2.5

Patched versions: 1.2.6

Vmagazine News

Affected versions: *-1.0.5

Patched versions: 1.0.6

AccessPress Parallax

Affected versions: *-4.5

Patched versions: 4.6

AccessPress Root

Affected versions: *-2.5

Patched versions: 2.6.0

AccessPress Staple

Affected versions: *-1.9.1

Patched versions: Not supplied

StoreVilla

Affected versions: *-1.4.1

Patched versions: 1.4.2

Ultra Seven

Affected versions: *-1.2.8

Patched versions: Not supplied

The100

Affected versions: *-1.1.2

Patched versions: Not supplied

Edict Lite

Affected versions: *-1.1.4

Patched versions: Not supplied

WP Store

Affected versions: *-1.1.9

Patched versions: 1.2.0

Opstore

Affected versions: *-1.4.3

Patched versions: 1.4.4

Bloger

Affected versions: *-1.2.6

Patched versions: 1.2.7

Researcher credit: R3N0

Applicable copyright and licence notices

This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

Licence reference

This record contains material that is subject to copyright

Copyright 1999-2026 The MITRE Corporation

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

Licence reference

Original Wordfence record
Published
January 11, 2022
CVSS
8.8
HighCVE-2022-23975

AccessPress Themes and Plugin <= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation

The Monday: Currently marked unpatchedDoko: Currently marked unpatchedEight Sec: Currently marked unpatchedRevolve: Currently marked unpatchedBingle: Currently marked unpatchedParallaxSome: Currently marked unpatchedUncode Lite: Currently marked unpatchedEightLaw Lite: Currently marked unpatchedAccessPress Lite: Currently marked unpatchedFotoGraphy: Currently marked unpatchedArrival: Currently marked unpatchedVMag: Currently marked unpatchedAccessPress Mag: Currently marked unpatchedSakala: Currently marked unpatchedVMagazine Lite: Currently marked unpatchedDigital Agency Lite: Currently marked unpatchedThe Launcher: Currently marked unpatchedZigcy Lite: Currently marked unpatchedBrovy: Currently marked unpatchedEightmedi Lite: Currently marked unpatchedWPparallax: Currently marked unpatchedEnlighten: Currently marked unpatchedEightStore Lite: Currently marked unpatchedAccessPress Store: Currently marked unpatchedSwing Lite: Currently marked unpatchedRipple: Currently marked unpatchedAccess Demo Importer: Currently marked unpatchedPunte: Currently marked unpatchedAccesspress Basic: Currently marked unpatchedZigcy Baby: Currently marked unpatchedScrollMe: Currently marked unpatchedZigcy Cosmetics: Currently marked unpatchedConstruction Lite: Currently marked unpatchedVmagazine News: Currently marked unpatchedAccessPress Parallax: Currently marked unpatchedAccessPress Root: Currently marked unpatchedStoreVilla: Currently marked unpatchedUltra Seven: Currently marked unpatchedThe100: Currently marked unpatchedEdict Lite: Currently marked unpatchedWP Store: Currently marked unpatchedOpstore: Currently marked unpatchedBloger: Currently marked unpatched

Affected versions: *-1.4.1; *-1.0.27; *-1.1.4; *-1.3.1; *-1.0.4; *-1.3.6; *-1.3.3; *-2.1.5

Vulnerability type: CWE-862 Missing Authorization

Affected software, patched versions and attribution

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to unauthorized plugin deactivation and activation via the plugin_activation_callback and plugin_deactivate_callback functions called via AJAX actions that were missing capability checks and nonce validation. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to deactivate and activate arbitrary plugins. This could be used to deactivate security plugins and exploit other potential vulnerabilities.

The Monday

Affected versions: *-1.4.1

Patched versions: Not supplied

Doko

Affected versions: *-1.0.27

Patched versions: 1.1.0

Eight Sec

Affected versions: *-1.1.4

Patched versions: Not supplied

Revolve

Affected versions: *-1.3.1

Patched versions: Not supplied

Bingle

Affected versions: *-1.0.4

Patched versions: 1.0.5

ParallaxSome

Affected versions: *-1.3.6

Patched versions: 1.3.7

Uncode Lite

Affected versions: *-1.3.3

Patched versions: Not supplied

EightLaw Lite

Affected versions: *-2.1.5

Patched versions: 2.1.6

AccessPress Lite

Affected versions: *-2.92

Patched versions: 2.93

FotoGraphy

Affected versions: *-2.4.0

Patched versions: 2.4.1

Arrival

Affected versions: *-1.4.2

Patched versions: 1.4.3

VMag

Affected versions: *-1.2.7

Patched versions: 1.2.8

AccessPress Mag

Affected versions: *-2.6.5

Patched versions: 2.6.6

Sakala

Affected versions: *-1.0.4

Patched versions: 1.0.5

VMagazine Lite

Affected versions: *-1.3.5

Patched versions: 1.3.6

Digital Agency Lite

Affected versions: *-1.1.6

Patched versions: 1.1.7

The Launcher

Affected versions: *-1.3.2

Patched versions: 1.3.3

Zigcy Lite

Affected versions: *-2.0.9

Patched versions: 2.1.0

Brovy

Affected versions: *-1.3

Patched versions: Not supplied

Eightmedi Lite

Affected versions: *-2.1.8

Patched versions: 2.1.9

WPparallax

Affected versions: *-2.0.6

Patched versions: Not supplied

Enlighten

Affected versions: *-1.3.5

Patched versions: 1.3.6

EightStore Lite

Affected versions: *-1.2.5

Patched versions: 1.2.6

AccessPress Store

Affected versions: *-2.4.9

Patched versions: 2.5.0

Swing Lite

Affected versions: *-1.1.9

Patched versions: 1.2.0

Ripple

Affected versions: *-1.2.1

Patched versions: Not supplied

Access Demo Importer

Affected versions: *-1.0.6

Patched versions: 1.0.7

Punte

Affected versions: *-1.1.2

Patched versions: 1.1.3

Accesspress Basic

Affected versions: *-3.2.1

Patched versions: 3.2.2

Zigcy Baby

Affected versions: *-1.0.6

Patched versions: 1.0.7

ScrollMe

Affected versions: *-2.1.0

Patched versions: Not supplied

Zigcy Cosmetics

Affected versions: *-1.0.5

Patched versions: 1.0.6

Construction Lite

Affected versions: *-1.2.5

Patched versions: 1.2.6

Vmagazine News

Affected versions: *-1.0.5

Patched versions: 1.0.6

AccessPress Parallax

Affected versions: *-4.5

Patched versions: 4.6

AccessPress Root

Affected versions: *-2.5

Patched versions: 2.6.0

StoreVilla

Affected versions: *-1.4.1

Patched versions: 1.4.2

Ultra Seven

Affected versions: *-1.2.8

Patched versions: Not supplied

The100

Affected versions: *-1.1.2

Patched versions: Not supplied

Edict Lite

Affected versions: *-1.1.4

Patched versions: Not supplied

WP Store

Affected versions: *-1.1.9

Patched versions: 1.2.0

Opstore

Affected versions: *-1.4.3

Patched versions: 1.4.4

Bloger

Affected versions: *-1.2.6

Patched versions: 1.2.7

Researcher credit: R3N0

Applicable copyright and licence notices

This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

Licence reference

This record contains material that is subject to copyright

Copyright 1999-2026 The MITRE Corporation

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

Licence reference

Original Wordfence record
Published
January 11, 2022
CVSS
8.8
HighCVE-2021-39317

AccessPress Themes and Plugin <= Various Versions - Authenticated (Subscriber+) Arbitrary File Upload

The Monday: Currently marked unpatchedDoko: Currently marked unpatchedEight Sec: Currently marked unpatchedRevolve: Currently marked unpatchedBingle: Currently marked unpatchedParallaxSome: Currently marked unpatchedUncode Lite: Currently marked unpatchedEightLaw Lite: Currently marked unpatchedAccessPress Lite: Currently marked unpatchedFotoGraphy: Currently marked unpatchedArrival: Currently marked unpatchedVMag: Currently marked unpatchedAccessPress Mag: Currently marked unpatchedSakala: Currently marked unpatchedVMagazine Lite: Currently marked unpatchedDigital Agency Lite: Currently marked unpatchedThe Launcher: Currently marked unpatchedZigcy Lite: Currently marked unpatchedBrovy: Currently marked unpatchedEightmedi Lite: Currently marked unpatchedWPparallax: Currently marked unpatchedEnlighten: Currently marked unpatchedEightStore Lite: Currently marked unpatchedAccessPress Store: Currently marked unpatchedSwing Lite: Currently marked unpatchedRipple: Currently marked unpatchedAccess Demo Importer: Currently marked unpatchedPunte: Currently marked unpatchedAccesspress Basic: Currently marked unpatchedZigcy Baby: Currently marked unpatchedScrollMe: Currently marked unpatchedZigcy Cosmetics: Currently marked unpatchedConstruction Lite: Currently marked unpatchedVmagazine News: Currently marked unpatchedAccessPress Parallax: Currently marked unpatchedAccessPress Root: Currently marked unpatchedAccessPress Staple: Currently marked unpatchedStoreVilla: Currently marked unpatchedUltra Seven: Currently marked unpatchedThe100: Currently marked unpatchedEdict Lite: Currently marked unpatchedWP Store: Currently marked unpatchedOpstore: Currently marked unpatchedBloger: Currently marked unpatched

Affected versions: *-1.4.1; *-1.0.27; *-1.1.4; *-1.3.1; *-1.0.4; *-1.3.6; *-1.3.3; *-2.1.5

Vulnerability type: CWE-434 Unrestricted Upload of File with Dangerous Type

Affected software, patched versions and attribution

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check in the plugin_offline_installer_callback function found in the /demo-functions.php file or /welcome.php file of the affected products.

The Monday

Affected versions: *-1.4.1

Patched versions: Not supplied

Doko

Affected versions: *-1.0.27

Patched versions: 1.1.0

Eight Sec

Affected versions: *-1.1.4

Patched versions: Not supplied

Revolve

Affected versions: *-1.3.1

Patched versions: Not supplied

Bingle

Affected versions: *-1.0.4

Patched versions: 1.0.5

ParallaxSome

Affected versions: *-1.3.6

Patched versions: 1.3.7

Uncode Lite

Affected versions: *-1.3.3

Patched versions: Not supplied

EightLaw Lite

Affected versions: *-2.1.5

Patched versions: 2.1.6

AccessPress Lite

Affected versions: *-2.92

Patched versions: 2.93

FotoGraphy

Affected versions: *-2.4.0

Patched versions: 2.4.1

Arrival

Affected versions: *-1.4.2

Patched versions: 1.4.3

VMag

Affected versions: *-1.2.7

Patched versions: 1.2.8

AccessPress Mag

Affected versions: *-2.6.5

Patched versions: 2.6.6

Sakala

Affected versions: *-1.0.4

Patched versions: 1.0.5

VMagazine Lite

Affected versions: *-1.3.5

Patched versions: 1.3.6

Digital Agency Lite

Affected versions: *-1.1.6

Patched versions: 1.1.7

The Launcher

Affected versions: *-1.3.2

Patched versions: 1.3.3

Zigcy Lite

Affected versions: *-2.0.9

Patched versions: 2.1.0

Brovy

Affected versions: *-1.3

Patched versions: Not supplied

Eightmedi Lite

Affected versions: *-2.1.8

Patched versions: 2.1.9

WPparallax

Affected versions: *-2.0.6

Patched versions: Not supplied

Enlighten

Affected versions: *-1.3.5

Patched versions: 1.3.6

EightStore Lite

Affected versions: *-1.2.5

Patched versions: 1.2.6

AccessPress Store

Affected versions: *-2.4.9

Patched versions: 2.5.0

Swing Lite

Affected versions: *-1.1.9

Patched versions: 1.2.0

Ripple

Affected versions: *-1.2.1

Patched versions: Not supplied

Access Demo Importer

Affected versions: *-1.0.6

Patched versions: 1.0.7

Punte

Affected versions: *-1.1.2

Patched versions: 1.1.3

Accesspress Basic

Affected versions: *-3.2.1

Patched versions: 3.2.2

Zigcy Baby

Affected versions: *-1.0.6

Patched versions: 1.0.7

ScrollMe

Affected versions: *-2.1.0

Patched versions: Not supplied

Zigcy Cosmetics

Affected versions: *-1.0.5

Patched versions: 1.0.6

Construction Lite

Affected versions: *-1.2.5

Patched versions: 1.2.6

Vmagazine News

Affected versions: *-1.0.5

Patched versions: 1.0.6

AccessPress Parallax

Affected versions: *-4.5

Patched versions: 4.6

AccessPress Root

Affected versions: *-2.5

Patched versions: 2.6.0

AccessPress Staple

Affected versions: *-1.9.1

Patched versions: Not supplied

StoreVilla

Affected versions: *-1.4.1

Patched versions: 1.4.2

Ultra Seven

Affected versions: *-1.2.8

Patched versions: Not supplied

The100

Affected versions: *-1.1.2

Patched versions: Not supplied

Edict Lite

Affected versions: *-1.1.4

Patched versions: Not supplied

WP Store

Affected versions: *-1.1.9

Patched versions: 1.2.0

Opstore

Affected versions: *-1.4.3

Patched versions: 1.4.4

Bloger

Affected versions: *-1.2.6

Patched versions: 1.2.7

Researcher credit: Chloe Chamberland, Lenon Leite, Lucio Sá

Applicable copyright and licence notices

This record contains material that is subject to copyright

Copyright 2012-2026 Defiant Inc.

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

Licence reference

This record contains material that is subject to copyright

Copyright 1999-2026 The MITRE Corporation

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

Licence reference

Original Wordfence record
Published
October 6, 2021
CVSS
8.8

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

Production Feed records are aggregated without claiming discovery, exploitation or infection. Applicable source notices remain attached to individual records. Read the methodology.