WordPress plugin
UiPress lite | Effortless custom dashboards, admin themes and pages security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical1
- High2
- Medium5
- Low0
All UiPress lite | Effortless custom dashboards, admin themes and pages vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium4.3 | Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update ≤3.5.09No patch available | CVE-2026-2294 | |
| Medium4.3 | Missing Authorization ≤3.5.09Update to 3.5.10 | CVE-2026-27091 | |
| Medium6.5 | Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure ≤3.5.09Update to 3.5.10 | CVE-2025-10938 | |
| Medium6.4 | Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting ≤3.5.09Update to 3.5.10 | CVE-2025-11003 | |
| Medium4.3 | Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update ≤3.5.08Update to 3.5.09 | CVE-2025-11815 | |
| High8.8 | Authenticated (Subscriber+) Remote Code Execution ≤3.5.07Update to 3.5.08 | CVE-2025-3053 | |
| High8.8 | Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update ≤3.5.04Update to 3.5.05 | CVE-2025-1309 | |
| Critical9.1 | Authenticated (Administrator+) SQL Injection ≤3.4.06Update to 3.4.07 | CVE-2024-38788 |
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update
≤3.5.09No patch available
- Medium4.3Missing Authorization
≤3.5.09Update to 3.5.10
- Medium6.5Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure
≤3.5.09Update to 3.5.10
- Medium6.4Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
≤3.5.09Update to 3.5.10
- Medium4.3Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update
≤3.5.08Update to 3.5.09
- High8.8Authenticated (Subscriber+) Remote Code Execution
≤3.5.07Update to 3.5.08
- High8.8Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
≤3.5.04Update to 3.5.05
- Critical9.1Authenticated (Administrator+) SQL Injection
≤3.4.06Update to 3.4.07
UiPress lite | Effortless custom dashboards, admin themes and pages: common questions
Does UiPress lite | Effortless custom dashboards, admin themes and pages have known vulnerabilities?
Yes. VulnCrest Radar lists 8 known vulnerabilities in UiPress lite | Effortless custom dashboards, admin themes and pages: 1 critical, 2 high, 5 medium. At least one is not fixed in the latest version.
How do I check which version of UiPress lite | Effortless custom dashboards, admin themes and pages I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent UiPress lite | Effortless custom dashboards, admin themes and pages vulnerability?
CVE-2026-2294, published Mar 20, 2026: UiPress lite | Effortless custom dashboards, admin themes and pages <= 3.5.09 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update. Severity: Medium (CVSS 4.3).
Is any UiPress lite | Effortless custom dashboards, admin themes and pages vulnerability listed in CISA KEV?
No. None of the known UiPress lite | Effortless custom dashboards, admin themes and pages vulnerabilities is currently listed in the CISA KEV catalog.