Brainstormforce
106 CVEs across 38 Brainstormforce products. Browse Brainstormforce vulnerabilities, severities, and proof-of-concept exploits.
Brainstormforce products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-7623 | Medium | 6.4 | 2026-08-01 | The SureForms – Contact Form, Payment Form & Other Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'headingWrappe… |
CVE-2026-15821 | Medium | 6.4 | 2026-07-24 | The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions… |
CVE-2026-15787 | Medium | 6.4 | 2026-07-22 | The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon… |
CVE-2026-12900 | Medium | 6.4 | 2026-07-20 | The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `uagb/image` bloc… |
CVE-2026-15288 | High | 7.5 | 2026-07-10 | The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including… |
CVE-2026-7465 | High | 8.8 | 2026-05-30 | The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and incl… |
CVE-2026-9065 | | 2026-05-20 | SureCart version prior to 4.2.1 are vulnerable to authenticated SQL injection via multiple parameters ('model_name', 'model_id', 'integration_id', 'provider')… | |
CVE-2026-4987 | High | 7.5 | 2026-03-28 | The SureForms – Contact Form, Payment Form & Other Custom Form Builder plugin for WordPress is vulnerable to Payment Amount Bypass in all versions up to, and i… |
CVE-2026-3534 | Medium | 6.4 | 2026-03-11 | The Astra theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `ast-page-background-meta` and `ast-content-background-meta` post meta field… |
CVE-2026-0950 | Medium | 5.3 | 2026-02-03 | The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and inc… |
CVE-2025-14351 | Medium | 5.3 | 2026-01-20 | The Custom Fonts – Host Your Fonts Locally plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'BCF_Google… |
CVE-2025-14855 | High | 7.2 | 2025-12-21 | The SureForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form field parameters in all versions up to, and including, 2.2.0 due t… |
CVE-2025-13065 | High | 8.8 | 2025-12-06 | The Starter Templates plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 4.4.41. This is due to insufficient fil… |
CVE-2025-13516 | High | 8.1 | 2025-12-02 | The SureMail – SMTP and Email Logs Plugin for WordPress is vulnerable to Unrestricted Upload of File with Dangerous Type in versions up to and including 1.9.0… |
CVE-2025-12535 | Medium | 5.3 | 2025-11-19 | The SureForms plugin for WordPress is vulnerable to Cross-Site Request Forgery Bypass in all versions up to, and including, 1.13.1. This is due to the plugin d… |
CVE-2025-12536 | Medium | 5.3 | 2025-11-13 | The SureForms plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.1 via the '_srfm_email_notificati… |
CVE-2025-11162 | Medium | 6.4 | 2025-11-05 | The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom CSS in all… |
CVE-2025-10732 | Medium | 4.3 | 2025-10-14 | The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and incl… |
CVE-2025-10489 | Medium | 4.3 | 2025-09-20 | The SureForms – Drag and Drop Contact Form Builder – Multi-step Forms, Conversational Forms and more plugin for WordPress is vulnerable to unauthorized creatio… |
CVE-2025-8488 | Medium | 4.3 | 2025-08-02 | The Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) plugin for WordPress is vulnerable to unauthorized modification of data due to a… |
CVE-2025-5921 | Medium | 5.8 | 2025-08-01 | The SureForms WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site… |
CVE-2025-6742 | High | 7.5 | 2025-07-09 | The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7.3… |
CVE-2025-6691 | High | 8.1 | 2025-07-09 | The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation… |
CVE-2025-3514 | Low | 3.5 | 2025-05-02 | The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to pe… |
CVE-2025-3513 | Low | 3.5 | 2025-05-02 | The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to pe… |
CVE-2025-3471 | Medium | 4.9 | 2025-04-30 | The SureForms WordPress plugin before 1.4.4 does not have proper authorisation check when updating its settings via the REST API, which could allow Contributo… |
CVE-2025-3102 | High | 8.1 | 2025-04-10 | The SureTriggers: All-in-One Automation Platform plugin for WordPress is vulnerable to an authentication bypass leading to administrative account creation due… |
CVE-2025-1784 | Medium | 6.4 | 2025-03-26 | The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the uagb block in all versions up to, and includ… |
CVE-2024-12713 | Medium | 5.3 | 2025-01-08 | The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.2… |
CVE-2024-56274 | Medium | 6.5 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Astra Widgets astra-widgets allows Store… |
CVE-2024-11230 | Medium | 6.4 | 2024-12-23 | The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘size’ parameter in all versions up to, and inc… |
CVE-2023-23834 | Medium | 4.3 | 2024-12-09 | Missing Authorization vulnerability in Brainstorm Force Spectra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spec… |
CVE-2023-23825 | Low | 3.1 | 2024-12-09 | Missing Authorization vulnerability in Brainstorm Force Spectra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spec… |
CVE-2024-10484 | Medium | 6.4 | 2024-12-03 | The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Team' widget in all versions up to… |
CVE-2024-10325 | Medium | 6.4 | 2024-11-08 | The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, an… |
CVE-2024-37517 | Medium | 4.3 | 2024-11-01 | Missing Authorization vulnerability in Brainstorm Force Spectra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spec… |
CVE-2024-50439 | Medium | 6.5 | 2024-10-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Astra Widgets astra-widgets allows Store… |
CVE-2024-10050 | Medium | 4.3 | 2024-10-24 | The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 1.6.43 via the hfe_tem… |
CVE-2024-7590 | Medium | 6.5 | 2024-08-12 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg al… |
CVE-2024-43151 | Medium | 6.5 | 2024-08-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Brainstorm Force Ultimate Addons for Beaver Builde… |
CVE-2024-33933 | Medium | 6.5 | 2024-07-22 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Brainstorm Force, Nikhil Chavan Elementor – Header… |
CVE-2024-37278 | Medium | 5.9 | 2024-07-22 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Pratik Chaskar Cards for Beaver Builder.This issue… |
CVE-2024-5255 | Medium | 6.4 | 2024-07-17 | The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ultimate_dual_color shortcode in all versio… |
CVE-2024-5254 | Medium | 6.4 | 2024-07-17 | The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ultimate_info_banner shortcode in all versi… |
CVE-2024-5253 | Medium | 6.4 | 2024-07-17 | The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ult_team shortcode in all versions up to, a… |
CVE-2024-5252 | Medium | 6.4 | 2024-07-17 | The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ultimate_info_table shortcode in all versio… |
CVE-2024-5251 | Medium | 6.4 | 2024-07-17 | The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ultimate_pricing shortcode in all versions… |
CVE-2024-37455 | High | 8.8 | 2024-07-09 | Improper Privilege Management vulnerability in Brainstorm Force Ultimate Addons for Elementor allows Privilege Escalation.This issue affects Ultimate Addons fo… |
CVE-2023-36684 | High | 7.1 | 2024-06-19 | Missing Authorization vulnerability in Brainstorm Force Convert Pro.This issue affects Convert Pro: from n/a through 1.7.5. |
CVE-2023-36676 | Medium | 5.4 | 2024-06-19 | Missing Authorization vulnerability in Brainstorm Force Spectra.This issue affects Spectra: from n/a through 2.6.6. |
CVE-2023-41805 | Medium | 6.5 | 2024-06-19 | Missing Authorization vulnerability in Brainstorm Force Premium Starter Templates, Brainstorm Force Starter Templates astra-sites.This issue affects Premium St… |
CVE-2023-44151 | Medium | 5.4 | 2024-06-19 | Missing Authorization vulnerability in Brainstorm Force Pre-Publish Checklist.This issue affects Pre-Publish Checklist: from n/a through 1.1.1. |
CVE-2023-44148 | Medium | 5.4 | 2024-06-19 | Missing Authorization vulnerability in Brainstorm Force Astra Bulk Edit.This issue affects Astra Bulk Edit: from n/a through 1.2.7. |
CVE-2024-4632 | Medium | 6.4 | 2024-06-19 | The WooCommerce Checkout & Funnel Builder by CartFlows – Create High Converting Stores For WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site… |
CVE-2023-51376 | Medium | 4.3 | 2024-06-14 | Missing Authorization vulnerability in Brainstorm Force ProjectHuddle Client Site.This issue affects ProjectHuddle Client Site: from n/a through 1.0.34. |
CVE-2024-5757 | Medium | 6.4 | 2024-06-13 | The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the url attribute within the plugin's Site Title w… |
CVE-2024-5485 | Medium | 6.4 | 2024-06-04 | The SureTriggers – Connect All Your Plugins, Apps, Tools & Automate Everything! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugi… |
CVE-2023-23738 | Medium | 5.3 | 2024-06-03 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Brainstorm Force Spectra allows Content Spo… |
CVE-2023-23735 | Medium | 5.3 | 2024-06-03 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brainstorm Force Spectra allows Code Injection.This issue affect… |
CVE-2023-23730 | Medium | 5.3 | 2024-06-03 | Improper Restriction of Excessive Authentication Attempts vulnerability in Brainstorm Force Spectra allows Functionality Bypass.This issue affects Spectra: fro… |
CVE-2024-4366 | Medium | 6.4 | 2024-05-24 | The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘block_id’ parameter in versions up to, and… |
CVE-2024-1332 | Medium | 6.4 | 2024-05-24 | The Custom Fonts – Host Your Fonts Locally plugin for WordPress is vulnerable to Stored Cross-Site Scripting via svg file upload in all versions up to, and inc… |
CVE-2024-2618 | Medium | 6.4 | 2024-05-24 | The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the size attribute in all versions up to, and inclu… |
CVE-2024-1815 | Medium | 6.4 | 2024-05-23 | The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Gallery block in all versions… |
CVE-2024-1814 | Medium | 6.4 | 2024-05-23 | The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Testimonial block in all versions u… |
CVE-2023-51401 | Medium | 6.3 | 2024-05-17 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Brainstorm Force Ultimate Addons for Beaver Builder allows Rela… |
CVE-2023-51398 | High | 8.8 | 2024-05-17 | Improper Privilege Management vulnerability in Brainstorm Force Ultimate Addons for Beaver Builder allows Privilege Escalation.This issue affects Ultimate Addo… |
CVE-2024-2619 | Medium | 5.0 | 2024-05-16 | The Elementor Header & Footer Builder for WordPress is vulnerable to HTML Injection in all versions up to, and including, 1.6.26 due to insufficient input sani… |
CVE-2024-4634 | Medium | 6.4 | 2024-05-16 | The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘hfe_svg_mime_types’ function in versions up to… |
CVE-2024-4630 | Medium | 6.4 | 2024-05-14 | The Starter Templates — Elementor, WordPress & Beaver Builder Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘custom_uploa… |
CVE-2024-1467 | Medium | 4.3 | 2024-05-14 | The Starter Templates — Elementor, WordPress & Beaver Builder Templates plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to… |
CVE-2024-3107 | Medium | 4.3 | 2024-05-02 | The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Path Traversal in versions up to, and including, 2.12.6 via the get_block_defaul… |
CVE-2024-2347 | Medium | 6.4 | 2024-04-09 | The Astra theme for WordPress is vulnerable to Stored Cross-Site Scripting via a user's display name in all versions up to, and including, 4.6.8 due to insuffi… |
CVE-2024-2305 | Medium | 6.4 | 2024-04-09 | The Cards for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the BootstrapCard link in all versions up to, and including… |
CVE-2023-6486 | Medium | 6.4 | 2024-04-09 | The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom CSS metabox in all versions up to and… |
CVE-2024-2144 | Medium | 6.4 | 2024-03-30 | The Ultimate Addons for Beaver Builder – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Separator widget in all versions… |
CVE-2024-2143 | Medium | 6.4 | 2024-03-30 | The Ultimate Addons for Beaver Builder – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Heading widget in all versions up to, a… |
CVE-2024-2142 | Medium | 6.4 | 2024-03-30 | The Ultimate Addons for Beaver Builder – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Info Table widget in all versions up to… |
CVE-2024-2141 | Medium | 6.4 | 2024-03-30 | The Ultimate Addons for Beaver Builder – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Button widget in all versions up to, an… |
CVE-2024-2140 | Medium | 6.4 | 2024-03-30 | The Ultimate Addons for Beaver Builder – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Advanced Icons widget in all versions u… |
CVE-2023-36679 | High | 7.1 | 2024-03-28 | Server-Side Request Forgery (SSRF) vulnerability in Brainstorm Force Spectra.This issue affects Spectra: from n/a through 2.6.6. |
CVE-2024-1564 | Medium | 4.3 | 2024-03-25 | The wp-schema-pro WordPress plugin before 2.7.16 does not validate post access allowing a contributor user to access custom fields on any post regardless of po… |
CVE-2024-1237 | Medium | 6.4 | 2024-03-13 | The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the flyout_layout attribute in all versions up to… |
CVE-2023-23882 | Medium | 4.3 | 2024-01-17 | Missing Authorization vulnerability in Brainstorm Force Ultimate Addons for Beaver Builder – Lite.This issue affects Ultimate Addons for Beaver Builder – Lite… |
CVE-2023-51402 | Medium | 4.3 | 2023-12-29 | Cross-Site Request Forgery (CSRF) vulnerability in Brain Storm Force Ultimate Addons for WPBakery Page Builder.This issue affects Ultimate Addons for WPBakery… |
CVE-2023-51397 | Medium | 6.5 | 2023-12-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force WP Remote Site Search allows Stored XSS… |
CVE-2023-49830 | Critical | 9.9 | 2023-12-29 | Improper Control of Generation of Code ('Code Injection') vulnerability in Brainstorm Force Astra Pro.This issue affects Astra Pro: from n/a through 4.3.1. |
CVE-2023-49833 | Medium | 6.5 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Spectra – WordPress Gutenberg Blocks all… |
CVE-2023-41804 | High | 7.1 | 2023-12-07 | Server-Side Request Forgery (SSRF) vulnerability in Brainstorm Force Starter Templates — Elementor, WordPress & Beaver Builder Templates.This issue affects Sta… |
CVE-2023-36685 | Medium | 4.3 | 2023-11-30 | Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force US LLC CartFlows Pro allows Cross Site Request Forgery.This issue affects CartFlows Pro: fr… |
CVE-2023-36682 | High | 7.1 | 2023-11-30 | Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force US LLC Schema Pro allows Cross Site Request Forgery.This issue affects Schema Pro: from n/a… |
CVE-2023-46211 | Medium | 6.5 | 2023-10-27 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Brainstorm Force Ultimate Addons for WPBakery Page Builder plugin <= 3.19.14 versions. |
CVE-2020-36747 | Medium | 4.3 | 2023-07-01 | The Lightweight Sidebar Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.4. This is due to missin… |
CVE-2020-36737 | Medium | 4.3 | 2023-07-01 | The Import / Export Customizer Settings plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.3. This is due t… |
CVE-2020-36736 | Medium | 4.3 | 2023-07-01 | The WooCommerce Checkout & Funnel Builder by CartFlows plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.1… |
CVE-2020-36702 | Medium | 5.5 | 2023-06-07 | The Ultimate Addons for Gutenberg plugin for WordPress is vulnerable to Authenticated Settings Change in versions up to, and including, 1.14.7. This is due to… |
CVE-2019-25151 | Medium | 5.4 | 2023-06-07 | The Funnel Builder plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the activate_plugin function in versions up… |
CVE-2023-25058 | Medium | 4.3 | 2023-05-26 | Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force Schema – All In One Schema Rich Snippets plugin <= 1.6.5 versions. |
CVE-2022-46851 | Medium | 4.3 | 2023-05-23 | Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force Starter Templates plugin <= 3.1.20 versions. |
CVE-2020-36656 | Medium | 5.4 | 2023-02-21 | The Spectra WordPress plugin before 1.15.0 does not sanitize user input as it reaches its style HTML attribute, allowing contributors to conduct stored XSS att… |