Brainstormforce vulnerabilities

Products

• Spectra 18
• Spectra Gutenberg Blocks – Website Builder For The Block Editor 11
• Ultimate Addons For Elementor 10
• Ultimate Addons For Beaver Builder 9
• Elementor Header \& Footer Builder 7
• Sureforms 7
• Sureforms – Contact Form, Payment Form & Other Custom Form Builder 7
• Ultimate Addons For Wpbakery Page Builder 7
• Astra 6
• Starter Templates 5
• Ultimate Addons For Beaver Builder – Lite 5
• Schema 4
• Suredash – Community, Courses & Member Dashboard 4
• Ultimate Addons For Elementor 4
• Cards For Beaver Builder 3
• Cartflows – Funnel Builder & Checkout Plugin For Woocommerce 3
• Elementor - Header\, Footer \& Blocks Template 3
• Spectra Legacy – Gutenberg Blocks 3
• Starter Templates – Ai-powered Templates For Elementor & Gutenberg 3
• Astra Widgets 2
• Cards For Beaver Builder 2
• Custom Fonts – Host Your Fonts Locally 2
• Ottokit: All-in-one Automation Platform 2
• Starter Templates — Elementor, Wordpress & Beaver Builder Templates 2
• Sureforms – Contact Form Builder, Ai Forms, Payment Form, Survey & Quiz 2
• Sureforms – Drag And Drop Form Builder For Wordpress 2

Newest

• brainstormforce spectra legacy – gutenberg blocks Spectra Gutenberg Blocks <= 2.20.4 - Missing Authorization to Unauthenticated Limited Theme File Deletion and Modification via 'page', 'path', and 'settings' GET Parameters CVE-2026-92294 6.5 MediumOctober 31, 2026
• brainstormforce suredash – community, courses & member dashboard SureDash <= 1.12.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter CVE-2026-96870 6.4 MediumOctober 16, 2026
• brainstormforce suredash – community, courses & member dashboard SureDash <= 1.12.1 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post Content CVE-2026-102774 6.4 MediumOctober 10, 2026
• brainstormforce spectra legacy – gutenberg blocks Spectra Legacy – Gutenberg Blocks <= 2.20.0 - Authenticated (Contributor+) Sensitive Information Exposure CVE-2026-16302 4.3 MediumSeptember 24, 2026
• brainstormforce sureforms – contact form builder, ai forms, payment form, survey & quiz SureForms <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Text Field Entity-Encoded Payload CVE-2026-18406 7.2 HighSeptember 5, 2026
• brainstormforce suredash – community, courses & member dashboard SureDash <= 1.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'draweropenverposition' Block/Shortcode Attribute CVE-2026-18402 6.4 MediumAugust 16, 2026
• brainstormforce sureforms – contact form builder, ai forms, payment form, survey & quiz SureForms <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'headingWrapper' Block Attribute CVE-2026-7623 6.4 MediumAugust 1, 2026
• brainstormforce suredash – community, courses & member dashboard SureDash <= 1.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes CVE-2026-15821 6.4 MediumJuly 24, 2026
• brainstorm force ultimate addons for elementor Ultimate Addons for Elementor <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes CVE-2026-15787 6.4 MediumJuly 22, 2026
• brainstormforce spectra legacy – gutenberg blocks Spectra Gutenberg Blocks <= 2.19.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via uagb/image Block CVE-2026-12900 6.4 MediumJuly 20, 2026
• brainstormforce sureforms – drag & drop contact form & form builder, payment form, survey, quiz & calculator SureForms – Drag and Drop Form Builder for WordPress <= 2.2.1 - Unauthenticated Stripe Payment Amount Manipulation CVE-2026-15288 7.5 HighJuly 10, 2026
• brainstormforce spectra gutenberg blocks – website builder for the block editor Spectra Gutenberg Blocks <= 2.19.25 - Authenticated (Contributor+) Remote Code Execution via Arbitrary PHP Function Call via Block Attributes CVE-2026-7465 Public exploit 8.8 HighMay 30, 2026
• brainstormforce surecart Surecart - SQL Injection CVE-2026-9065 9.3 CriticalMay 20, 2026
• brainstormforce sureforms – contact form, payment form & other custom form builder SureForms <= 2.5.2 - Unauthenticated Payment Amount Validation Bypass via 'form_id' CVE-2026-4987 7.5 HighMarch 28, 2026
• brainstormforce astra Astra <= 4.12.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta CVE-2026-3534 6.4 MediumMarch 11, 2026
• brainstormforce spectra gutenberg blocks – website builder for the block editor Spectra Gutenberg Blocks <= 2.19.17 - Unauthenticated Information Disclosure in Sensitive Data CVE-2026-0950 5.3 MediumFebruary 3, 2026
• brainstormforce custom fonts – host your fonts locally Custom Fonts – Host Your Fonts Locally <= 2.1.16 - Missing Authorization to Unauthenticated Font Deletion CVE-2025-14351 5.3 MediumJanuary 20, 2026
• brainstormforce sureforms – contact form, payment form & other custom form builder SureForms <= 2.2.0 - Unauthenticated Stored Cross-Site Scripting CVE-2025-14855 Public exploit 7.2 HighDecember 21, 2025
• brainstormforce starter templates – ai-powered templates for elementor & gutenberg Starter Templates <= 4.4.41 - Authenticated (Author+) Arbitrary File Upload via WXR Upload Bypass CVE-2025-13065 EPSS 13.5% 8.8 HighDecember 6, 2025
• brainstormforce suremail – smtp and email logs plugin with amazon ses, postmark, and other providers SureMail – SMTP and Email Logs Plugin with Amazon SES, Postmark, and Other Providers <= 1.9.0 - Unauthenticated Arbitrary File Upload CVE-2025-13516 8.1 HighDecember 2, 2025
• brainstormforce sureforms – contact form, payment form & other custom form builder SureForms <= 1.13.1 - Cross-Site Request Forgery Protection Bypass via Improper Nonce Distribution CVE-2025-12535 5.3 MediumNovember 19, 2025
• brainstormforce sureforms – contact form, payment form & other custom form builder SureForms <= 1.13.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure CVE-2025-12536 5.3 MediumNovember 13, 2025
• brainstormforce spectra gutenberg blocks – website builder for the block editor Spectra <= 2.19.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom CSS CVE-2025-11162 6.4 MediumNovember 5, 2025
• brainstormforce sureforms – contact form, payment form & other custom form builder SureForms – Drag and Drop Form Builder for WordPress <= 1.12.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure CVE-2025-10732 4.3 MediumOctober 14, 2025
• brainstormforce sureforms – contact form, payment form & other custom form builder SureForms – Drag and Drop Form Builder for WordPress <= 1.12.0 - Missing Authorization to Authenticated (Contributor+) Form Creation CVE-2025-10489 4.3 MediumSeptember 20, 2025
• brainstorm force ultimate addons for elementor Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) <= 2.4.6 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update CVE-2025-8488 4.3 MediumAugust 2, 2025
• brainstormforce sureforms SureForms < 1.7.2 - Reflected XSS CVE-2025-5921 5.8 MediumAugust 1, 2025
• brainstormforce sureforms, sureforms – drag and drop form builder for wordpress +1 more SureForms – Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated PHP Object Injection (PHAR) Triggered via Admin Submission Deletion CVE-2025-6742 7.5 HighJuly 9, 2025
• brainstormforce sureforms, sureforms – drag and drop form builder for wordpress +1 more SureForms – Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Submission Deletion CVE-2025-6691 8.1 HighJuly 9, 2025
• brainstormforce sureforms SureForms < 1.4.4 - Admin+ Stored XSS CVE-2025-3514 3.5 LowMay 2, 2025
• brainstormforce sureforms SureForms < 1.4.4 - Admin+ Stored XSS CVE-2025-3513 3.5 LowMay 2, 2025
• brainstormforce sureforms SureForms < 1.4.4 - Contributor+ Settings Update CVE-2025-3471 4.9 MediumApril 30, 2025
• brainstormforce ottokit: all-in-one automation platform SureTriggers <= 1.0.78 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Administrative User Creation CVE-2025-3102 Public exploit EPSS 76.2% 8.1 HighApril 10, 2025
• brainstormforce spectra gutenberg blocks – website builder for the block editor Spectra – WordPress Gutenberg Blocks <= 2.19.0 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-1784 6.4 MediumMarch 26, 2025
• brainstormforce sureforms, sureforms – contact form, payment form & other custom form builder +1 more SureForms – Drag and Drop Form Builder for WordPress <= 1.2.2 - Missing Authorization to Unauthenticated Protected Post Disclosure CVE-2024-12713 5.3 MediumJanuary 8, 2025
• brainstorm force astra widgets WordPress Astra Widgets plugin <= 1.2.15 - Cross Site Scripting (XSS) vulnerability CVE-2024-56274 6.5 MediumJanuary 7, 2025
• brainstorm force ultimate addons for elementor, brainstormforce elementor header \& footer builder +1 more Elementor Header & Footer Builder <= 1.6.46 - Authenticated (Contributor+) Stored Cross-Site Scripting via Page Title Widget CVE-2024-11230 6.4 MediumDecember 23, 2024
• brainstorm force spectra WordPress Spectra – WordPress Gutenberg Blocks plugin <= 2.3.0 - Broken Access Control + CSRF on Import_WPforms vulnerability CVE-2023-23825 3.1 LowDecember 9, 2024
• brainstorm force spectra WordPress Spectra – WordPress Gutenberg Blocks plugin <= 2.3.0 - Broken Access Control + CSRF on Activate_Plugin vulnerability CVE-2023-23834 4.3 MediumDecember 9, 2024
• brainstormforce spectra, spectra gutenberg blocks – website builder for the block editor +1 more Spectra – WordPress Gutenberg Blocks <= 2.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Widget CVE-2024-10484 6.4 MediumDecember 3, 2024
• brainstorm force ultimate addons for elementor, brainstormforce elementor header \& footer builder +1 more Elementor Header & Footer Builder <= 1.6.45 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload CVE-2024-10325 6.4 MediumNovember 8, 2024
• brainstorm force spectra WordPress Spectra plugin <= 2.13.7 - Broken Access Control vulnerability CVE-2024-37517 4.3 MediumNovember 1, 2024
• brainstorm force astra widgets WordPress Astra Widgets plugin <= 1.2.14 - Stored Cross Site Scripting (XSS) vulnerability CVE-2024-50439 6.5 MediumOctober 28, 2024
• brainstorm force ultimate addons for elementor, brainstormforce elementor header \& footer builder +1 more Elementor Header & Footer Builder <= 1.6.43 - Authenticated (Contributor+) Information Disclosure via Shortcode CVE-2024-10050 4.3 MediumOctober 24, 2024
• brainstorm force ultimate addons for beaver builder – lite, brainstormforce ultimate addons for beaver builder +1 more WordPress Ultimate Addons for Beaver Builder – Lite plugin <= 1.5.9 - Cross Site Scripting (XSS) vulnerability CVE-2024-43151 6.5 MediumAugust 12, 2024
• brainstorm force spectra WordPress Spectra plugin<= 2.14.1 - Cross Site Scripting (XSS) vulnerability CVE-2024-7590 6.5 MediumAugust 12, 2024
• brainstorm force, nikhil chavan elementor – header, footer & blocks template, brainstormforce elementor - header\, footer \& blocks template +1 more WordPress Elementor Header & Footer Builder plugin <= 1.6.35 - Contributor+ DOM-Based Cross Site Scripting (XSS) vulnerability CVE-2024-33933 6.5 MediumJuly 22, 2024
• brainstormforce cards for beaver builder WordPress Cards for Beaver Builder plugin <= 1.1.4 - Cross Site Scripting (XSS) vulnerability CVE-2024-37278 5.9 MediumJuly 22, 2024
• brainstorm force ultimate addons for wpbakery, brainstormforce ultimate addons for wpbakery page builder +1 more Ultimate Addons for WPBakery Page Builder <= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2024-5251 6.4 MediumJuly 17, 2024
• brainstorm force ultimate addons for wpbakery, brainstormforce ultimate addons for wpbakery page builder +1 more Ultimate Addons for WPBakery Page Builder <= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2024-5253 6.4 MediumJuly 17, 2024
• Show olderLoading…