https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 23:45:11 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2025-15096 <p>The &#39;Videospirecore Theme Plugin&#39; plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.6. This is due to the plugin not properly validating a user&#39;s identity prior to updating their details like email. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary user&#39;s email addresses, including administrators, and leverage that to reset the user&#39;s password and gain access to their account.</p> <p>The &#39;Videospirecore Theme Plugin&#39; plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.6. This is due to the plugin not properly validating a user&#39;s identity prior to updating their details like email. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary user&#39;s email addresses, including administrators, and leverage that to reset the user&#39;s password and gain access to their account.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2025-15096 https://vulnerability.circl.lu/vuln/ghsa-x35m-4mv2-6m4p <p>The &#39;Videospirecore Theme Plugin&#39; plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.6. This is due to the plugin not properly validating a user&#39;s identity prior to updating their details like email. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary user&#39;s email addresses, including administrators, and leverage that to reset the user&#39;s password and gain access to their account.</p> <p>The &#39;Videospirecore Theme Plugin&#39; plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.6. This is due to the plugin not properly validating a user&#39;s identity prior to updating their details like email. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary user&#39;s email addresses, including administrators, and leverage that to reset the user&#39;s password and gain access to their account.</p> https://vulnerability.circl.lu/vuln/ghsa-x35m-4mv2-6m4p