Vendor
dreamstechnologies
8 known vulnerabilities.
7 results · Clear filters · Feed
-
Critical 9.8
Mentoring <= 1.2.8 - Unauthenticated Privilege Escalation in mentoring_process_registration
The Mentoring plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.2.8. This is due to the plugin not properly restricting the roles that users can register with in the mentoring_process_registration() function. T…
-
Critical 9.8
Listee <= 1.1.6 - Unauthenticated Privilege Escalation
The Listee theme for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.1.6. This is due to a broken validation check in the bundled listee-core plugin's user registration function that fails to properly sanitize the user_…
-
Critical 9.8
Truelysell Core <= 1.8.7 - Unauthenticated Privilege Escalation via Registration
The Truelysell Core plugin for WordPress is vulnerable to privilege escalation in versions less than, or equal to, 1.8.7. This is due to insufficient validation of the user_role parameter during user registration. This makes it possible for unauthenticated at…
-
Critical 9.8
Doccure Core < 1.5.4 - Unauthenticated Privilege Escalation
The Doccure Core plugin for WordPress is vulnerable to privilege escalation in versions up to, and excluding, 1.5.4. This is due to the plugin allowing users who are registering new accounts to set their own role or by supplying 'user_type' field. This makes …
-
Critical 9.8
Truelysell Core <= 1.8.6 - Unauthenticated Arbitrary User Password Change
The Truelysell Core plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.8.6. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system reso…
-
Critical 9.8
Doccure <= 1.5.0 - Unauthenticated Arbitrary User Password Change
The Doccure theme for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.5.0. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. Th…
-
Critical 9.8
Doccure Core <= 1.5.3 - Unauthenticated Arbitrary File Upload
The Doccure Core plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'doccure_temp_upload_to_media' function in all versions up to, and including, 1.5.3. This makes it possible for unauthenticated attackers …