ConvertPlus vulnerabilities

4 known vulnerabilities in ConvertPlus from Brainstorm Force. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  ConvertPlus: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-87741Sep 28, 2026Brainstorm Force

  The ConvertPlus plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 3.6.3 via the style parameter of the cp_display_preview_modal AJAX action. The vulnerability exists because the action's nonce guard i

• 8.1 High severity

  ConvertPlus: Missing Authorization

  CVE-2024-13800Feb 12, 2025Brainstorm Force

  The ConvertPlus plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'cp_dismiss_notice' AJAX endpoint in all versions up to, and including, 3.5.30. This makes it

• 7.5 High severity

  ConvertPlus: Deserialization of Untrusted Data

  CVE-2024-4838May 16, 2024Brainstorm Force

  The ConvertPlus plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.5.26 via deserialization of untrusted input from the 'settings_encoded' attribute of the 'smile_modal' shortcode. This makes it possible for auth

• 8.8 High severity

  ConvertPlus: Deserialization of Untrusted Data

  CVE-2024-3240May 4, 2024Brainstorm Force

  The ConvertPlug plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.5.25 via deserialization of untrusted input from the 'settings_encoded' attribute of the 'smile_info_bar' shortcode. This makes it possible for a