CVE-2021-46116: Jpress

High severity, CVSS 7.2. EPSS: 2.2% chance of exploitation in the next 30 days.

jpress 4.2.0 is vulnerable to remote code execution via io.jpress.web.admin._TemplateController#doInstall. The admin panel provides a function through which attackers can install templates and inject some malicious code.

Affected products

• Jpress Jpress: version 4.2.0 only

Published 2022-01-26. Last modified 2026-07-09.