Brainstorm Force vulnerabilities, page 3
87 vulnerabilities
Known vulnerabilities in Brainstorm Force products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 34 products.
CVE-2026-102393brainstorm forcestarter templates+1
EPSS score0.16%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Starter Templates astra-sites allows Stored XSS.This issue affects Starter Templates: from n/a through 4.7.7.CVE-2026-102914brainstorm forcepresto player+1EPSS score0.16%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Presto Player presto-player allows Stored XSS.This issue affects Presto Player: from n/a through 4.5.2.CVE-2026-39477brainstorm forcecartflows+1EPSS score0.23%
Missing Authorization vulnerability in Brainstorm Force CartFlows cartflows allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CartFlows: from n/a through <= 2.2.3.CVE-2026-39721brainstorm forcestarter templates+1EPSS score0.17%
Missing Authorization vulnerability in Brainstorm Force Starter Templates astra-sites allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Starter Templates: from n/a through 4.7.7.CVE-2026-39479brainstorm forceottokit+1EPSS score0.38%
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Brainstorm Force OttoKit suretriggers allows Blind SQL Injection.This issue affects OttoKit: from n/a through <= 1.1.20.CVE-2026-39470brainstorm forcewoocommerce cart abandonment recovery+1EPSS score0.46%
Shop manager Privilege Escalation in WooCommerce Cart Abandonment Recovery < 2.1.0 versions.CVE-2026-25316brainstorm forcecartflows+1EPSS score0.44%
Deserialization of Untrusted Data vulnerability in Brainstorm Force CartFlows cartflows allows Object Injection.This issue affects CartFlows: from n/a through <= 2.1.19.CVE-2026-66698brainstorm forcesuredash+1EPSS score0.25%
Unauthenticated Cross Site Scripting (XSS) in SureDash <= 1.10.1 versions.CVE-2026-66688brainstorm forceultimate addons for elementor+1EPSS score0.22%
Contributor Cross Site Scripting (XSS) in Ultimate Addons for Elementor <= 1.45.2 versions.CVE-2026-27085brainstorm forceastra wordpress theme+1EPSS score0.23%
Shop manager Content Injection in Astra WordPress Theme <= 4.13.12 versions.CVE-2026-57401brainstorm forcesuredash+1EPSS score0.55%
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Brainstorm Force SureDash suredash allows Path Traversal.This issue affects SureDash: from n/a through <= 1.8.0.CVE-2026-80433brainstorm forcesurefeedback client site+1EPSS score0.39%
Subscriber Sensitive Data Exposure in SureFeedback Client Site <= 1.2.12 versions.CVE-2026-24962brainstorm forcesigmize+1EPSS score0.13%
Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force Sigmize sigmize allows Cross Site Request Forgery.This issue affects Sigmize: from n/a through <= 0.0.9.CVE-2026-24982brainstorm forcespectra+1EPSS score0.26%
Missing Authorization vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through <= 2.19.17.CVE-2026-45442brainstorm forcepresto player+1EPSS score0.27%
Missing Authorization vulnerability in Brainstorm Force Presto Player allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects Presto Player: from n/a through 4.1.3.CVE-2026-28038brainstorm forceultimate addons for wpbakery page builder+1EPSS score0.31%
Missing Authorization vulnerability in Brainstorm_Force Ultimate Addons for WPBakery Page Builder ultimate_vc_addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Addons for WPBakery Page Builder: from n/a through <= 3.21.1.CVE-2026-49781brainstorm forceottokit+1EPSS score0.56%
Unauthenticated PHP Object Injection in OttoKit <= 1.1.27 versions.CVE-2026-96837brainstorm forcecartflows+1EPSS score0.54%
Contributor Remote Code Execution (RCE) in CartFlows <= 3.2.0 versions.CVE-2026-32431brainstorm forceastra bulk edit+1EPSS score0.23%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Astra Bulk Edit astra-bulk-edit allows DOM-Based XSS.This issue affects Astra Bulk Edit: from n/a through <= 1.2.10.CVE-2026-32553brainstorm forceottokit+1EPSS score0.27%
Unauthenticated Server Side Request Forgery (SSRF) in OttoKit <= 1.1.35 versions.