CveMateVulnerability intelligence

Brainstorm Force vulnerabilities

86 vulnerabilities

Known vulnerabilities in Brainstorm Force products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 34 products.

Products

34

Spectra12 vulnerabilities
Starter Templates7 vulnerabilities
Ultimate Addons For Wpbakery6 vulnerabilities
Convertplus5 vulnerabilities
Suredash5 vulnerabilities
Ultimate Addons For Wpbakery Page Builder5 vulnerabilities
Ottokit4 vulnerabilities
Astra Widgets3 vulnerabilities
Cartflows3 vulnerabilities
Presto Player3 vulnerabilities
Surecart3 vulnerabilities
Ultimate Addons For Elementor3 vulnerabilities
Astra Bulk Edit2 vulnerabilities
Premium Starter Templates2 vulnerabilities
Spectra Pro2 vulnerabilities
Starter Templates — Elementor, Wordpress & Beaver Builder Templates2 vulnerabilities
Sureforms2 vulnerabilities
Ultimate Addons For Beaver Builder2 vulnerabilities
Ultimate Addons For Beaver Builder – Lite2 vulnerabilities
Astra1 vulnerabilities
Astra Pro1 vulnerabilities
Astra Wordpress Theme1 vulnerabilities
Convert Pro1 vulnerabilities
Pre Publish Checklist1 vulnerabilities
Projecthuddle Client Site1 vulnerabilities
Schema – All In One Schema Rich Snippets1 vulnerabilities
Sigmize1 vulnerabilities
Spectra – Wordpress Gutenberg Blocks1 vulnerabilities
Surefeedback Client Site1 vulnerabilities
Sureforms Pro1 vulnerabilities
Suremembers1 vulnerabilities
Surerank1 vulnerabilities
Woocommerce Cart Abandonment Recovery1 vulnerabilities
WP Remote Site Search1 vulnerabilities

CVE-2026-110372brainstorm forceottokit12h ago18-10-2026 11:00Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This issue affects OttoKit: from n/a through 1.1.40.CVE-2026-109893brainstorm forcepresto player3d ago15-10-2026 18:18

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Presto Player presto-player allows Stored XSS.This issue affects Presto Player: from n/a through 4.5.3.CVE-2026-106599brainstorm forcesurecart4d ago14-10-2026 12:08

Deserialization of Untrusted Data vulnerability in Brainstorm Force SureCart surecart allows Object Injection.This issue affects SureCart: from n/a through 4.9.3.CVE-2026-105874brainstorm forcesurecart4d ago14-10-2026 12:08

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Reflected XSS.This issue affects SureCart: from n/a through 4.9.3.CVE-2026-109697brainstorm forcesurecart5d ago13-10-2026 08:41

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.4.CVE-2026-108495brainstorm forcesureforms5d ago13-10-2026 08:30

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureForms sureforms allows Stored XSS.This issue affects SureForms: from n/a through 2.12.7.CVE-2025-54685brainstorm forcesuredash+11y ago14-08-2025 10:34

Insertion of Sensitive Information Into Sent Data vulnerability in Brainstorm Force SureDash suredash allows Retrieve Embedded Sensitive Data.This issue affects SureDash: from n/a through <= 1.1.0.CVE-2025-62059brainstorm forcesurerank+111mo ago06-11-2025 15:55

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureRank surerank.This issue affects SureRank: from n/a through <= 1.3.2.CVE-2025-11814brainstorm forceultimate addons for wpbakery+11y ago16-10-2025 04:27

The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to 3.21.1 (exclusive) due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2025-68497brainstorm forceastra widgets+19mo ago24-12-2025 12:31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Astra Widgets astra-widgets allows Stored XSS.This issue affects Astra Widgets: from n/a through <= 1.2.16.CVE-2025-48088brainstorm forceultimate addons for wpbakery page builder+111mo ago27-10-2025 02:09

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm_Force Ultimate Addons for WPBakery Page Builder ultimate_vc_addons allows Stored XSS.This issue affects Ultimate Addons for WPBakery Page Builder: from n/a through < 3.21.1.CVE-2025-48164brainstorm forcesuredash+11y ago20-08-2025 08:03

Incorrect Privilege Assignment vulnerability in Brainstorm Force SureDash suredash allows Privilege Escalation.This issue affects SureDash: from n/a through <= 1.0.3.CVE-2025-27007brainstorm forceottokit+11y ago01-05-2025 10:54

Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This issue affects OttoKit: from n/a through <= 1.0.82.CVE-2025-24568brainstorm forcestarter templates+11y ago24-01-2025 17:24

Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force Starter Templates astra-sites allows Cross Site Request Forgery.This issue affects Starter Templates: from n/a through <= 4.4.9.CVE-2022-46851brainstorm forcestarter templates+23y ago23-05-2023 13:07

Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force Starter Templates plugin <= 3.1.20 versions.CVE-2024-13800brainstorm forceconvertplus+21y ago12-02-2025 04:22

The ConvertPlus plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'cp_dismiss_notice' AJAX endpoint in all versions up to, and including, 3.5.30. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update option values to '1' on the WordPress site. This can be leveraged to update an option that would create an error on the site and deny service to legitimate users or be used to set some values to true such as registration.CVE-2024-47345brainstorm forcestarter templates+12y ago06-10-2024 10:32

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Starter Templates astra-sites allows Stored XSS.This issue affects Starter Templates: from n/a through <= 4.4.0.CVE-2024-4838brainstorm forceconvertplus+12y ago16-05-2024 11:05

The ConvertPlus plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.5.26 via deserialization of untrusted input from the 'settings_encoded' attribute of the 'smile_modal' shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.CVE-2024-37517brainstorm forcespectra+21y ago01-11-2024 14:18

Missing Authorization vulnerability in Brainstorm Force Spectra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through 2.13.7.CVE-2024-37455brainstorm forceultimate addons for elementor+22y ago09-07-2024 10:48

Improper Privilege Management vulnerability in Brainstorm Force Ultimate Addons for Elementor allows Privilege Escalation.This issue affects Ultimate Addons for Elementor: from n/a through 1.36.31.