Dreamstechnologies vulnerabilities
We track 8 vulnerabilities in Dreamstechnologies products across 5 products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on May 5, 2026.
Latest Dreamstechnologies vulnerabilities
- 9.8 Critical severity
Mentoring: Improper Privilege Management
The Mentoring plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.2.8. This is due to the plugin not properly restricting the roles that users can register with in the mentoring_process_registration() function. Th
- 9.8 Critical severity
Listee: Improper Privilege Management
The Listee theme for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.1.6. This is due to a broken validation check in the bundled listee-core plugin's user registration function that fails to properly sanitize the user_r
- 9.8 Critical severity
Truelysell Core: Improper Privilege Management
The Truelysell Core plugin for WordPress is vulnerable to privilege escalation in versions less than, or equal to, 1.8.7. This is due to insufficient validation of the user_role parameter during user registration. This makes it possible for unauthenticated att
- 9.8 Critical severity
Doccure Core: Improper Privilege Management
The Doccure Core plugin for WordPress is vulnerable to privilege escalation in versions up to, and excluding, 1.5.4. This is due to the plugin allowing users who are registering new accounts to set their own role or by supplying 'user_type' field. This makes i
- 9.8 Critical severity
Truelysell Core: Authorization Bypass Through User-Controlled Key
The Truelysell Core plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.8.6. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resou
- 9.8 Critical severity
Doccure: Authorization Bypass Through User-Controlled Key
The Doccure theme for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.5.0. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. Thi
- 9.8 Critical severity
Doccure Core: Unrestricted Upload of File with Dangerous Type
The Doccure Core plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'doccure_temp_upload_to_media' function in all versions up to, and including, 1.5.3. This makes it possible for unauthenticated attackers t
- 8.8 High severity
Doccure: Unrestricted Upload of File with Dangerous Type
The Doccure theme for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the 'doccure_temp_file_uploader' function in all versions up to, and including, 1.5.0. This makes it possible for authenticated attackers, with sub