Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

182 records

Vendor: Brainstorm Force Clear all filters
TI-2026-86511 CVE-2026-120842 · GHSA-379c-f73j-j7q5

Missing authorization in WordPress SureForms plugin

Priority LOW 27

Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureForms: from n/a through 2.13.0.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS — Published 2026-11-07 No fix listed CWE-862
TI-2026-86509 CVE-2026-119520 · GHSA-2j7x-372f-94rv

Stored cross-site scripting in WordPress Spectra plugin

Priority LOW 26

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Stored XSS.This issue affects Spectra: from n/a through…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS — Published 2026-11-07 No fix listed CWE-79
TI-2026-86479 CVE-2026-120853 · GHSA-cwv5-g62v-46hh

Missing authorization in WordPress CartFlows plugin

Priority LOW 30

Missing Authorization vulnerability in Brainstorm Force CartFlows cartflows allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CartFlows: from n/a through 3.3.0.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00282 Published 2026-11-07 No fix listed CWE-862
TI-2026-86478 CVE-2026-120852 · GHSA-h36m-hww6-v4xr

Cross-site scripting in WordPress CartFlows plugin

Priority LOW 24

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brainstorm Force CartFlows cartflows allows Code Injection.This issue affects CartFlows: from n/a through 3.3.0.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00324 Published 2026-11-07 No fix listed CWE-80
TI-2026-83459 CVE-2026-92294 · GHSA-2mm6-8x3p-cx55

Spectra Gutenberg Blocks lets unauthenticated users delete theme files

Priority LOW 35

The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to limited file deletion due to insufficient file path validation in the '__construct' function in all versions up to…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00444 Published 2026-10-31 No fix listed CWE-862
TI-2026-83267 CVE-2026-39739 · GHSA-7mf7-6mwm-hxwq

Stored XSS in Ultimate Addons for Elementor - Lite WordPress plugin

Priority LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Ultimate Addons for Elementor - Lite header-footer-elementor allows Stored XSS.This issue affects Ult…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00204 Published 2026-10-30 No fix listed CWE-79
TI-2026-82436 CVE-2026-115605 · GHSA-7vh4-jhh3-cwf4

Missing authorization in WordPress SureDash plugin

Priority LOW 20

Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.3.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00234 Published 2026-10-29 No fix listed CWE-862
TI-2026-82432 CVE-2026-110881 · GHSA-rqqj-cmvw-97qc

Stored cross-site scripting in WordPress SureDash plugin

Priority LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureDash suredash allows Stored XSS.This issue affects SureDash: from n/a through 1.12.3.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.0017 Published 2026-10-29 No fix listed CWE-79
TI-2026-82445 CVE-2026-116387 · GHSA-r926-fqqx-6j36

Missing authorization in WordPress SureForms plugin

Priority LOW 29

Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureForms: from n/a through 2.12.9.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00176 Published 2026-10-29 No fix listed CWE-862
TI-2026-82446 CVE-2026-116402 · GHSA-6v4r-cxcw-rvc8

Cross-site scripting in WordPress SureForms plugin

Priority LOW 24

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brainstorm Force SureForms sureforms allows Code Injection.This issue affects SureForms: from n/a through 2.12.9.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.003 Published 2026-10-29 No fix listed CWE-80
TI-2026-80048 CVE-2026-110892 · GHSA-9rrp-m5j3-3cwq

Missing authorization in SureDash WordPress plugin

Priority LOW 29

Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00296 Published 2026-10-24 No fix listed CWE-862
TI-2026-79233 CVE-2026-112241 · GHSA-g8wf-f8pm-3fxm

Authentication bypass by spoofing in WordPress SureCart plugin

Priority MEDIUM 49

Authentication Bypass by Spoofing vulnerability in Brainstorm Force SureCart surecart allows Authentication Abuse.This issue affects SureCart: from n/a through 4.9.5.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0046 Published 2026-10-22 No fix listed CWE-290
TI-2026-79221 CVE-2026-110893 · GHSA-j5xg-4455-jxww

Missing authorization in WordPress SureDash plugin

Priority LOW 30

Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00276 Published 2026-10-22 No fix listed CWE-862
TI-2026-79222 CVE-2026-110894 · GHSA-737v-56mc-g5fw

Missing authorization in WordPress SureDash plugin

Priority LOW 30

Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00256 Published 2026-10-22 No fix listed CWE-862
TI-2026-78806 CVE-2026-112221 · GHSA-qxhf-h57v-6gc2

Stored cross-site scripting in WordPress SureCart plugin

Priority LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.5.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00202 Published 2026-10-21 No fix listed CWE-79
TI-2026-76911 CVE-2026-112840 · GHSA-r597-rh52-9mhf

Stored cross-site scripting in WordPress SureCart plugin

Priority LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.5.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00204 Published 2026-10-20 No fix listed CWE-79
TI-2026-76041 CVE-2026-110372 · GHSA-ghvv-6rmw-phh7

Privilege escalation in WordPress OttoKit plugin

Priority MEDIUM 52

Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This issue affects OttoKit: from n/a through 1.1.40.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01365 Published 2026-10-18 No fix listed CWE-266
TI-2026-75241 CVE-2026-96870 · GHSA-rcpx-g8xc-wvvp

Stored cross-site scripting in SureDash plugin for WordPress

Priority LOW 28

The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 1.12.0 due to insufficient inp…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.002 Published 2026-10-16 No fix listed CWE-79
TI-2026-74891 CVE-2026-109893

Stored cross-site scripting in WordPress Presto Player plugin

Priority LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Presto Player presto-player allows Stored XSS.This issue affects Presto Player: from n/a through 4.5.…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00156 Published 2026-10-15 No fix listed CWE-79
TI-2026-73970 CVE-2026-105874 · GHSA-vxwr-575v-6jcq

Reflected cross-site scripting in WordPress SureCart plugin

Priority LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Reflected XSS.This issue affects SureCart: from n/a through 4.9.3.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00198 Published 2026-10-14 No fix listed CWE-79
TI-2026-73971 CVE-2026-106599 · GHSA-mvf2-mxq8-3r6r

PHP object injection in WordPress SureCart plugin

Priority MEDIUM 40

Deserialization of Untrusted Data vulnerability in Brainstorm Force SureCart surecart allows Object Injection.This issue affects SureCart: from n/a through 4.9.3.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00408 Published 2026-10-14 No fix listed CWE-502
TI-2026-71628 CVE-2026-109697 · GHSA-5g29-c8mx-9hvf

Stored cross-site scripting in WordPress SureCart plugin

Priority LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.4.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00135 Published 2026-10-13 No fix listed CWE-79
TI-2026-71615 CVE-2026-108495 · GHSA-h9h6-5gvf-xhxp

Stored cross-site scripting in WordPress SureForms plugin

Priority LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureForms sureforms allows Stored XSS.This issue affects SureForms: from n/a through 2.12.7.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00135 Published 2026-10-13 No fix listed CWE-79
TI-2026-70231 CVE-2026-102774 · GHSA-hv84-qp5f-whrj

Stored cross-site scripting in SureDash via image alt attribute

Priority LOW 28

The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post Content in all versions up to, and including, 1…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00267 Published 2026-10-10 No fix listed CWE-79
Load more