Threepress
Threepress has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Threepress has a vendor fix available, so running the current release closes it.
All of these findings were reported by zakaria. Threepress is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.8.8.
CVE-2024-13395Threepress <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records
Threepress
Author
kerryoco
Easily embed three.js in WordPress What you can do: Create three.js galleries anywhere Create galleries using the shortcode generator in the Threepress admin, and then paste the shortcode wherever you want – the javascript that renders the shortcodes is loaded on all public pages. A gallery renders one three.js Scene. To customize the layout or dimensions of your gallery, use CSS. An id tag of form #threepress-gallery-[gallery name] is put on the wrapper of the <canvas> element, or use class .threepress-gallery / .threepress-gallery canvas to target all galleries. The gallery renderer (three.js object) should adjust to match your given dimensions automatically to prevent skewing or blurring. If you want to custom code your own gallery, scroll down to ‘javascript devs’. Notes All models must be in “.glb” format – most 3d programs can export to this. They are stored in the Media Library like everything else, but can be found easily through the Threepress library, which simply filters for “.glb” extensions. For javascript devs: All the galleries on a given page will be available in the global variable THREEPRESS, in the galleries property. See the Gallery class (static/js/ThreepressGallery.js) for insight on interacting with these.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C