Brainstorm Force vulnerabilities

Products

• Spectra 13
• SureDash 11
• Starter Templates 7
• SureCart 7
• SureForms 6
• Ultimate Addons for WPBakery 6
• CartFlows 5
• ConvertPlus 5
• OttoKit 5
• Ultimate Addons for WPBakery Page Builder 5
• Astra Widgets 3
• Presto Player 3
• Ultimate Addons for Elementor 3
• Astra Bulk Edit 2
• Premium Starter Templates 2
• Spectra Pro 2
• Starter Templates — Elementor, WordPress & Beaver Builder Templates 2
• SureRank 2
• Ultimate Addons for Beaver Builder 2
• Ultimate Addons for Beaver Builder – Lite 2
• Astra 1
• Astra Pro 1
• Astra WordPress Theme 1
• Convert Pro 1
• Pre-Publish Checklist 1
• ProjectHuddle Client Site 1
• Schema – All In One Schema Rich Snippets 1
• Sigmize 1
• Spectra – WordPress Gutenberg Blocks 1
• SureFeedback Client Site 1

Latest Brainstorm Force CVEs

Newest publication first · page 1 of 5

1. CVE-2026-125763 WordPress SureForms plugin <= 2.13.0 - Broken Access Control vulnerability

   Published 2026-11-11

   Medium·CVSS 5.3 EPSS 0.28%

   Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureForms: from n/a through 2.13.0.

2. CVE-2026-125450 WordPress SureRank plugin <= 1.10.3 - Cross Site Scripting (XSS) vulnerability

   Published 2026-11-11

   Medium·CVSS 6.5 EPSS 0.24%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureRank surerank allows Stored XSS.This issue affects SureRank: from n/a through 1.10.3.

3. CVE-2026-124411 WordPress SureCart plugin <= 4.12.1 - Cross Site Scripting (XSS) vulnerability

   Published 2026-11-11

   Medium·CVSS 6.5 EPSS 0.24%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.12.1.

4. CVE-2026-120842 WordPress SureForms plugin <= 2.13.0 - Broken Access Control vulnerability

   Published 2026-11-07

   Medium·CVSS 5.3 EPSS 0.27%

   Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureForms: from n/a through 2.13.0.

5. CVE-2026-119520 WordPress Spectra plugin <= 2.20.4 - Cross Site Scripting (XSS) vulnerability

   Published 2026-11-07

   Medium·CVSS 6.5 EPSS 0.20%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Stored XSS.This issue affects Spectra: from n/a through 2.20.4.

6. CVE-2026-120853 WordPress CartFlows plugin <= 3.3.0 - Broken Access Control vulnerability

   Published 2026-11-07

   Medium·CVSS 5.3 EPSS 0.28%

   Missing Authorization vulnerability in Brainstorm Force CartFlows cartflows allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CartFlows: from n/a through 3.3.0.

7. CVE-2026-120852 WordPress CartFlows plugin <= 3.3.0 - Content Injection vulnerability

   Published 2026-11-07

   Medium·CVSS 5.3 EPSS 0.24%

   Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brainstorm Force CartFlows cartflows allows Code Injection.This issue affects CartFlows: from n/a through 3.3.0.

8. CVE-2026-115604 WordPress SureDash plugin <= 1.12.3 - Arbitrary File Deletion vulnerability

   Published 2026-10-30

   Medium·CVSS 5.0 EPSS 0.43%

   Subscriber Arbitrary File Deletion in SureDash <= 1.12.3 versions.

9. CVE-2026-39739 WordPress Ultimate Addons for Elementor - Lite plugin <= 2.9.5 - Cross Site Scripting (XSS) vulnerability

   Published 2026-10-30

   Medium·CVSS 6.5 EPSS 0.20%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Ultimate Addons for Elementor - Lite header-footer-elementor allows Stored XSS.This issue affects Ultimate Addons for Elementor - Lite: from n/a through 2.9.5.

10. CVE-2026-115605 WordPress SureDash plugin <= 1.12.3 - Broken Access Control vulnerability

    Published 2026-10-29

    Medium·CVSS 4.3 EPSS 0.23%

    Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.3.

11. CVE-2026-110881 WordPress SureDash plugin <= 1.12.3 - Cross Site Scripting (XSS) vulnerability

    Published 2026-10-29

    Medium·CVSS 6.5 EPSS 0.17%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureDash suredash allows Stored XSS.This issue affects SureDash: from n/a through 1.12.3.

12. CVE-2026-116387 WordPress SureForms plugin <= 2.12.9 - Broken Access Control vulnerability

    Published 2026-10-29

    Medium·CVSS 5.3 EPSS 0.18%

    Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureForms: from n/a through 2.12.9.

13. CVE-2026-116402 WordPress SureForms plugin <= 2.12.9 - Content Injection vulnerability

    Published 2026-10-29

    Medium·CVSS 5.3 EPSS 0.30%

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brainstorm Force SureForms sureforms allows Code Injection.This issue affects SureForms: from n/a through 2.12.9.

14. CVE-2026-110892 WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability

    Published 2026-10-24

    Medium·CVSS 6.5 EPSS 0.30%

    Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2.

15. CVE-2026-112241 WordPress SureCart plugin <= 4.9.5 - Broken Authentication vulnerability

    Published 2026-10-22

    Critical·CVSS 9.8 EPSS 0.46%

    Authentication Bypass by Spoofing vulnerability in Brainstorm Force SureCart surecart allows Authentication Abuse.This issue affects SureCart: from n/a through 4.9.5.

16. CVE-2026-110893 WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability

    Published 2026-10-22

    Medium·CVSS 5.3 EPSS 0.28%

    Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2.

17. CVE-2026-110894 WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability

    Published 2026-10-22

    Medium·CVSS 5.3 EPSS 0.26%

    Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2.

18. CVE-2026-112221 WordPress SureCart plugin <= 4.9.5 - Cross Site Scripting (XSS) vulnerability

    Published 2026-10-21

    High·CVSS 7.1 EPSS 0.20%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.5.

19. CVE-2026-112840 WordPress SureCart plugin <= 4.9.5 - Cross Site Scripting (XSS) vulnerability

    Published 2026-10-20

    Medium·CVSS 6.5 EPSS 0.20%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.5.

20. CVE-2026-110372 WordPress OttoKit plugin <= 1.1.40 - Privilege Escalation vulnerability

    Published 2026-10-18

    Critical·CVSS 9.8 EPSS 1.4%

    Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This issue affects OttoKit: from n/a through 1.1.40.

21. CVE-2026-109893 WordPress Presto Player plugin <= 4.5.3 - Cross Site Scripting (XSS) vulnerability

    Published 2026-10-15

    Medium·CVSS 6.5 EPSS 0.16%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Presto Player presto-player allows Stored XSS.This issue affects Presto Player: from n/a through 4.5.3.

22. CVE-2026-105874 WordPress SureCart plugin <= 4.9.3 - Cross Site Scripting (XSS) vulnerability

    Published 2026-10-14

    High·CVSS 7.1 EPSS 0.20%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Reflected XSS.This issue affects SureCart: from n/a through 4.9.3.

23. CVE-2026-106599 WordPress SureCart plugin <= 4.9.3 - PHP Object Injection vulnerability

    Published 2026-10-14

    High·CVSS 8.8 EPSS 0.41%

    Deserialization of Untrusted Data vulnerability in Brainstorm Force SureCart surecart allows Object Injection.This issue affects SureCart: from n/a through 4.9.3.

24. CVE-2026-109697 WordPress SureCart plugin <= 4.9.4 - Cross Site Scripting (XSS) vulnerability

    Published 2026-10-13

    Medium·CVSS 6.5 EPSS 0.14%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.4.

25. CVE-2026-108495 WordPress SureForms plugin <= 2.12.7 - Cross Site Scripting (XSS) vulnerability

    Published 2026-10-13

    Medium·CVSS 6.5 EPSS 0.14%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureForms sureforms allows Stored XSS.This issue affects SureForms: from n/a through 2.12.7.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.