AmentoTech vulnerabilities

🔔 Create alert RSS

Published CVEs affecting AmentoTech products: 14 record(s), with severity, exploitation and fixes.

Doctreat 3 Taskbot 3 Tuturn 2 Workreap Core 2 Doctreat Core 2 Workreap (theme's plugin) 2

Exploited only (KEV) →

CVE-2026-39773 Critical · 10.0 CWE-266 Oct 6, 2026

WordPress Doctreat Core plugin <= 1.7.0 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Doctreat Core <= 1.7.0 versions.

CVE-2026-39770 Critical · 10.0 CWE-434 Oct 6, 2026

WordPress Doctreat theme <= 1.7.0 - Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload in Doctreat <= 1.7.0 versions.

CVE-2026-39759 Critical · 9.9 CWE-434 Oct 6, 2026

WordPress Workreap Core plugin <= 3.4.5 - Arbitrary File Upload vulnerability

Employer / Sales Representative Arbitrary File Upload in Workreap Core <= 3.4.5 versions.

CVE-2026-39757 Critical · 9.9 CWE-434 Oct 6, 2026

WordPress Taskbot plugin <= 6.6 - Arbitrary File Upload vulnerability

Subscriber Arbitrary File Upload in Taskbot <= 6.6 versions.

CVE-2026-39753 Critical · 9.8 CWE-266 Oct 6, 2026

WordPress Taskbot plugin <= 6.6 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in Taskbot <= 6.6 versions.

CVE-2025-6254 Critical · 9.8 CWE-269 Jun 10, 2026

Doctreat Core <= 1.6.8 - Unauthenticated Privilege Escalation

The Doctreat Core plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.6.8. This is due to the doctreat_process_registration() function not properly restricting the roles that a user can register with. This makes it possible for unauthenticated attackers to register as an administrator user.

CVE-2025-69101 Critical · 9.8 CWE-288 Jan 22, 2026

WordPress Workreap Core plugin <= 3.4.1 - Broken Authentication vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in AmentoTech Workreap Core workreap_core allows Authentication Abuse.This issue affects Workreap Core: from n/a through <= 3.4.1.

CVE-2025-22728 High · 8.5 CWE-89 Jan 8, 2026

WordPress Workreap (theme's plugin) plugin <= 3.3.6 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech Workreap (theme's plugin) workreap allows SQL Injection.This issue affects Workreap (theme's plugin): from n/a through <= 3.3.6.

CVE-2025-64236 Critical · 9.8 CWE-288 Dec 18, 2025

WordPress Tuturn plugin < 3.6 - Broken Authentication vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in AmentoTech Tuturn allows Authentication Abuse.This issue affects Tuturn: from n/a before 3.6.

CVE-2025-64235 Medium · 6.5 CWE-22 Dec 18, 2025

WordPress Tuturn plugin < 3.6 - Arbitrary File Download vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AmentoTech Tuturn allows Path Traversal.This issue affects Tuturn: from n/a before 3.6.

CVE-2025-59566 High · 7.7 CWE-22 Oct 22, 2025

WordPress Workreap (theme's plugin) plugin <= 3.3.5 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AmentoTech Workreap (theme's plugin) workreap allows Path Traversal.This issue affects Workreap (theme's plugin): from n/a through <= 3.3.5.

CVE-2025-58971 High · 7.1 CWE-79 Oct 22, 2025

WordPress Doctreat theme <= 1.6.7 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AmentoTech Doctreat doctreat allows Reflected XSS.This issue affects Doctreat: from n/a through <= 1.6.7.

CVE-2025-58970 Medium · 6.3 CWE-80 Oct 22, 2025

WordPress Doctreat theme <= 1.6.7 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in AmentoTech Doctreat doctreat allows Code Injection.This issue affects Doctreat: from n/a through <= 1.6.7.

CVE-2025-58959 High · 7.7 CWE-22 Oct 22, 2025

WordPress Taskbot plugin <= 6.4 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AmentoTech Taskbot taskbot allows Path Traversal.This issue affects Taskbot: from n/a through <= 6.4.