Brainstorm Force
70 CVEs across 30 Brainstorm Force products. Browse Brainstorm Force vulnerabilities, severities, and proof-of-concept exploits.
Brainstorm Force products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-32553 | High | 7.2 | 2026-08-18 | Unauthenticated Server Side Request Forgery (SSRF) in OttoKit <= 1.1.35 versions. |
CVE-2026-66698 | High | 7.1 | 2026-08-13 | Unauthenticated Cross Site Scripting (XSS) in SureDash <= 1.10.1 versions. |
CVE-2026-66688 | Medium | 6.5 | 2026-08-06 | Contributor Cross Site Scripting (XSS) in Ultimate Addons for Elementor <= 1.45.2 versions. |
CVE-2026-57401 | Critical | 9.9 | 2026-07-13 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Brainstorm Force SureDash suredash allows Path Traversal.This i… |
CVE-2026-54813 | High | 8.5 | 2026-06-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Brainstorm Force SureDash allows Blind SQL Injection. Th… |
CVE-2026-49781 | Critical | 9.8 | 2026-06-15 | Unauthenticated PHP Object Injection in OttoKit <= 1.1.27 versions. |
CVE-2026-39470 | High | 7.2 | 2026-06-15 | Shop manager Privilege Escalation in WooCommerce Cart Abandonment Recovery < 2.1.0 versions. |
CVE-2026-45442 | Medium | 4.3 | 2026-05-19 | Missing Authorization vulnerability in Brainstorm Force Presto Player allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affe… |
CVE-2026-42648 | Medium | 4.3 | 2026-04-29 | Missing Authorization vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2026-42377 | High | 7.3 | 2026-04-29 | Missing Authorization vulnerability in Brainstorm Force SureForms Pro allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affe… |
CVE-2026-39479 | High | 7.6 | 2026-04-08 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Brainstorm Force OttoKit suretriggers allows Blind SQL In… |
CVE-2026-39477 | Medium | 4.3 | 2026-04-08 | Missing Authorization vulnerability in Brainstorm Force CartFlows cartflows allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2026-34889 | Medium | 6.5 | 2026-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Ultimate Addons for WPBakery Page Builde… |
CVE-2026-32431 | Medium | 6.5 | 2026-03-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Astra Bulk Edit astra-bulk-edit allows D… |
CVE-2026-25316 | High | 7.2 | 2026-02-19 | Deserialization of Untrusted Data vulnerability in Brainstorm Force CartFlows cartflows allows Object Injection.This issue affects CartFlows: from n/a through… |
CVE-2026-24982 | Medium | 5.3 | 2026-02-03 | Missing Authorization vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2026-24962 | Medium | 4.3 | 2026-02-03 | Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force Sigmize sigmize allows Cross Site Request Forgery.This issue affects Sigmize: from n/a thro… |
CVE-2025-68497 | Medium | 5.9 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Astra Widgets astra-widgets allows Store… |
CVE-2023-23729 | Medium | 5.4 | 2025-12-09 | Missing Authorization vulnerability in Brainstorm Force Spectra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spec… |
CVE-2025-62059 | High | 7.1 | 2025-11-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureRank surerank.This issue affects Sur… |
CVE-2025-11814 | Medium | 6.4 | 2025-10-16 | The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to 3.21.1 (exclusive) due to insufficient… |
CVE-2025-48164 | High | 8.8 | 2025-08-20 | Incorrect Privilege Assignment vulnerability in Brainstorm Force SureDash suredash allows Privilege Escalation.This issue affects SureDash: from n/a through <=… |
CVE-2025-54685 | Medium | 6.5 | 2025-08-14 | Insertion of Sensitive Information Into Sent Data vulnerability in Brainstorm Force SureDash suredash allows Retrieve Embedded Sensitive Data.This issue affect… |
CVE-2025-27007 | Critical | 9.8 | 2025-05-01 | Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This issue affects OttoKit: from n/a through… |
CVE-2024-12434 | Medium | 5.3 | 2025-02-26 | The SureMembers plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.10.6 via the REST API. This makes… |
CVE-2024-13800 | High | 8.1 | 2025-02-12 | The ConvertPlus plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check… |
CVE-2025-24568 | Medium | 4.3 | 2025-01-24 | Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force Starter Templates astra-sites allows Cross Site Request Forgery.This issue affects Starter… |
CVE-2024-56274 | Medium | 6.5 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Astra Widgets astra-widgets allows Store… |
CVE-2023-23834 | Medium | 4.3 | 2024-12-09 | Missing Authorization vulnerability in Brainstorm Force Spectra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spec… |
CVE-2023-23825 | Low | 3.1 | 2024-12-09 | Missing Authorization vulnerability in Brainstorm Force Spectra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spec… |
CVE-2024-37517 | Medium | 4.3 | 2024-11-01 | Missing Authorization vulnerability in Brainstorm Force Spectra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spec… |
CVE-2024-50439 | Medium | 6.5 | 2024-10-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Astra Widgets astra-widgets allows Store… |
CVE-2024-47345 | Medium | 5.9 | 2024-10-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Starter Templates astra-sites allows Sto… |
CVE-2024-7590 | Medium | 6.5 | 2024-08-12 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg al… |
CVE-2024-43151 | Medium | 6.5 | 2024-08-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Brainstorm Force Ultimate Addons for Beaver Builde… |
CVE-2024-3827 | Medium | 6.4 | 2024-08-02 | The Spectra Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via block ids in all versions up to, and including, 1.1.4 due to insufficient… |
CVE-2024-5255 | Medium | 6.4 | 2024-07-17 | The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ultimate_dual_color shortcode in all versio… |
CVE-2024-5254 | Medium | 6.4 | 2024-07-17 | The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ultimate_info_banner shortcode in all versi… |
CVE-2024-5253 | Medium | 6.4 | 2024-07-17 | The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ult_team shortcode in all versions up to, a… |
CVE-2024-5252 | Medium | 6.4 | 2024-07-17 | The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ultimate_info_table shortcode in all versio… |
CVE-2024-5251 | Medium | 6.4 | 2024-07-17 | The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ultimate_pricing shortcode in all versions… |
CVE-2024-37455 | High | 8.8 | 2024-07-09 | Improper Privilege Management vulnerability in Brainstorm Force Ultimate Addons for Elementor allows Privilege Escalation.This issue affects Ultimate Addons fo… |
CVE-2023-36684 | High | 7.1 | 2024-06-19 | Missing Authorization vulnerability in Brainstorm Force Convert Pro.This issue affects Convert Pro: from n/a through 1.7.5. |
CVE-2023-36676 | Medium | 5.4 | 2024-06-19 | Missing Authorization vulnerability in Brainstorm Force Spectra.This issue affects Spectra: from n/a through 2.6.6. |
CVE-2023-41805 | Medium | 6.5 | 2024-06-19 | Missing Authorization vulnerability in Brainstorm Force Premium Starter Templates, Brainstorm Force Starter Templates astra-sites.This issue affects Premium St… |
CVE-2023-44151 | Medium | 5.4 | 2024-06-19 | Missing Authorization vulnerability in Brainstorm Force Pre-Publish Checklist.This issue affects Pre-Publish Checklist: from n/a through 1.1.1. |
CVE-2023-44148 | Medium | 5.4 | 2024-06-19 | Missing Authorization vulnerability in Brainstorm Force Astra Bulk Edit.This issue affects Astra Bulk Edit: from n/a through 1.2.7. |
CVE-2023-51376 | Medium | 4.3 | 2024-06-14 | Missing Authorization vulnerability in Brainstorm Force ProjectHuddle Client Site.This issue affects ProjectHuddle Client Site: from n/a through 1.0.34. |
CVE-2023-23738 | Medium | 5.3 | 2024-06-03 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Brainstorm Force Spectra allows Content Spo… |
CVE-2023-23735 | Medium | 5.3 | 2024-06-03 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brainstorm Force Spectra allows Code Injection.This issue affect… |
CVE-2023-23730 | Medium | 5.3 | 2024-06-03 | Improper Restriction of Excessive Authentication Attempts vulnerability in Brainstorm Force Spectra allows Functionality Bypass.This issue affects Spectra: fro… |
CVE-2023-51401 | Medium | 6.3 | 2024-05-17 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Brainstorm Force Ultimate Addons for Beaver Builder allows Rela… |
CVE-2023-51398 | High | 8.8 | 2024-05-17 | Improper Privilege Management vulnerability in Brainstorm Force Ultimate Addons for Beaver Builder allows Privilege Escalation.This issue affects Ultimate Addo… |
CVE-2023-50890 | High | 8.8 | 2024-05-17 | Improper Privilege Management vulnerability in Brainstorm Force Ultimate Addons for Elementor allows Privilege Escalation.This issue affects Ultimate Addons fo… |
CVE-2023-46205 | High | 7.1 | 2024-05-17 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Brainstorm Force Ultimate Addons for WPBakery Page Builder allo… |
CVE-2024-4838 | High | 7.5 | 2024-05-16 | The ConvertPlus plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.5.26 via deserialization of untrusted input… |
CVE-2024-3828 | High | 8.8 | 2024-05-14 | The Spectra Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.1.5. This is due to the plugin allowing lowe… |
CVE-2024-3240 | High | 8.8 | 2024-05-04 | The ConvertPlug plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.5.25 via deserialization of untrusted input… |
CVE-2024-3237 | Medium | 5.4 | 2024-05-04 | The ConvertPlug plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the cp_dismiss_notice() function i… |
CVE-2023-36679 | High | 7.1 | 2024-03-28 | Server-Side Request Forgery (SSRF) vulnerability in Brainstorm Force Spectra.This issue affects Spectra: from n/a through 2.6.6. |
CVE-2023-34370 | High | 7.1 | 2024-03-28 | Server-Side Request Forgery (SSRF) vulnerability in Brainstorm Force Starter Templates — Elementor, WordPress & Beaver Builder Templates, Brainstorm Force Prem… |
CVE-2024-29768 | Medium | 5.9 | 2024-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Astra allows Stored XSS.This issue affec… |
CVE-2023-23882 | Medium | 4.3 | 2024-01-17 | Missing Authorization vulnerability in Brainstorm Force Ultimate Addons for Beaver Builder – Lite.This issue affects Ultimate Addons for Beaver Builder – Lite… |
CVE-2023-51397 | Medium | 6.5 | 2023-12-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force WP Remote Site Search allows Stored XSS… |
CVE-2023-49830 | Critical | 9.9 | 2023-12-29 | Improper Control of Generation of Code ('Code Injection') vulnerability in Brainstorm Force Astra Pro.This issue affects Astra Pro: from n/a through 4.3.1. |
CVE-2023-49833 | Medium | 6.5 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Spectra – WordPress Gutenberg Blocks all… |
CVE-2023-41804 | High | 7.1 | 2023-12-07 | Server-Side Request Forgery (SSRF) vulnerability in Brainstorm Force Starter Templates — Elementor, WordPress & Beaver Builder Templates.This issue affects Sta… |
CVE-2023-46211 | Medium | 6.5 | 2023-10-27 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Brainstorm Force Ultimate Addons for WPBakery Page Builder plugin <= 3.19.14 versions. |
CVE-2023-25058 | Medium | 4.3 | 2023-05-26 | Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force Schema – All In One Schema Rich Snippets plugin <= 1.6.5 versions. |
CVE-2022-46851 | Medium | 4.3 | 2023-05-23 | Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force Starter Templates plugin <= 3.1.20 versions. |