Brainstorm Force CartFlows vulnerabilities

Latest Brainstorm Force CartFlows CVEs

Newest publication first

1. CVE-2026-120853 WordPress CartFlows plugin <= 3.3.0 - Broken Access Control vulnerability

   Published 2026-11-07

   Medium·CVSS 5.3 EPSS 0.28%

   Missing Authorization vulnerability in Brainstorm Force CartFlows cartflows allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CartFlows: from n/a through 3.3.0.

2. CVE-2026-120852 WordPress CartFlows plugin <= 3.3.0 - Content Injection vulnerability

   Published 2026-11-07

   Medium·CVSS 5.3 EPSS 0.24%

   Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brainstorm Force CartFlows cartflows allows Code Injection.This issue affects CartFlows: from n/a through 3.3.0.

3. CVE-2026-96837 WordPress CartFlows plugin <= 3.2.0 - Remote Code Execution (RCE) vulnerability

   Published 2026-09-30

   High·CVSS 8.8 EPSS 0.53%

   Contributor Remote Code Execution (RCE) in CartFlows <= 3.2.0 versions.

4. CVE-2026-39477 WordPress CartFlows plugin <= 2.2.3 - Broken Access Control vulnerability

   Published 2026-04-08

   Medium·CVSS 4.3 EPSS 0.22%

   Missing Authorization vulnerability in Brainstorm Force CartFlows cartflows allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CartFlows: from n/a through <= 2.2.3.

5. CVE-2026-25316 WordPress CartFlows plugin <= 2.1.19 - PHP Object Injection vulnerability

   Published 2026-02-19

   High·CVSS 7.2 EPSS 0.44%

   Deserialization of Untrusted Data vulnerability in Brainstorm Force CartFlows cartflows allows Object Injection.This issue affects CartFlows: from n/a through <= 2.1.19.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.