OnePress

OnePress has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2025; 3 are fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 5.4, and the most serious one scores 6.4 out of 10. 2025 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 2 of the records (50%). Other recurring categories include Cross-Site Request Forgery (CSRF), Missing Authorization.

3 of the records (75%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2025.

4 independent researchers contributed these findings, one record each. OnePress is installed on roughly 60,000 WordPress sites, so each unpatched flaw has a wide blast radius.

Strategic Overview

Avg CVSSMedium

5.4/ 10

Patch Coverage75%

Open

Fixed

Get automatic notifications for all OnePress vulnerabilities before they are exploited.

Most severe open issueCVSS 6.4CVE-2025-5092

Multiple Plugins and Themes <= (Various Versions) - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via lightGallery JavaScript Library

Read the full analysis

Vulnerability Records

4 records


2025-11-19 00:00	Multiple Plugins and Themes <= (Various Versions) - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via lightGallery JavaScript Library OnePress <= 2.3.16	`CVE-2025-5092`	6.4 Medium	Webbernaut	No
2025-02-03 00:00	OnePress <= 2.3.14 - Missing Authorization OnePress <= 2.3.14	`CVE-2025-22643`	4.3 Medium	Fariq Fadillah Gusti Insani (fariqfgi)	Yes
2024-07-11 00:00	OnePress <= 2.3.8 - Authenticated (Author+) Stored Cross-Site Scripting OnePress <= 2.3.8	`CVE-2024-38739`	6.4 Medium	stealthcopter	Yes
2024-06-28 00:00	OnePress <= 2.3.6 - Cross-Site Request Forgery via save_settings() OnePress <= 2.3.6	`CVE-2024-37448`	4.3 Medium	Dhabaleshwar Das	Yes

Showing 1–4 of 4 reports

Latestv2.3.23

OnePress

Author

FameThemes

4.6(154)

92/100

Last Updated

2026-09-11 (2d ago)

Active Installs

60,000+

Downloads

2,615,952

Requires WP

Requires PHP

7.4+

Created

2016-02-08 (11y ago)

OnePress is an outstanding creative and flexible WordPress one page theme well suited for business website, portfolio, digital agency, product showcase, freelancers and everyone else who appreciate good design. The theme overall is an elegant and classic one, a fine example of Bootstrap 4 WordPress theme which compatibility with latest version of WooCommerce. (Live preview : https://demos.famethemes.com/onepress)