Brainstormforce vulnerabilities
We track 19 vulnerabilities in Brainstormforce products across 17 products. 19 are rated high or critical, and none are known to be exploited. The most recent was published on November 13, 2026.
Latest Brainstormforce vulnerabilities
- 8.8 High severity
SureDash – Community, Courses & Member Dashboard: Improper Privilege Management
The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.13.0 This is due to the `save_settings()` REST handler at `/suredash/v1/save-settings` being gated only by `
- 7.2 High severity
SureForms – Contact Form Builder, AI Forms…: Improper Neutralization of Input During Web Page Generation
The SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Text Field Entity-Encoded Payload in all versions up to, and including, 2.12.2 due to insufficient input sanitizat
- 7.5 High severity
The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to…
The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 2.2.1. This is due to the plugin accepting the payment amount directly from user-controlled POST data
- 8.8 High severity
Spectra Gutenberg Blocks – Website Builder for…: Improper Privilege Management
The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.19.25. This makes it possible for authenticated attackers, with Contributor-level access and
- 9.3 Critical severity
Surecart: Improper Neutralization of Special Elements used in an SQL Command
SureCart version prior to 4.2.1 are vulnerable to authenticated SQL injection via multiple parameters ('model_name', 'model_id', 'integration_id', 'provider') on the REST API endpoint '/surecart/v1/integrations/{id}'. The root cause is a flawed escaping bypass
- 7.5 High severity
The SureForms – Contact Form, Payment Form & Other Custom Form Builder plugin for WordPress is…
The SureForms – Contact Form, Payment Form & Other Custom Form Builder plugin for WordPress is vulnerable to Payment Amount Bypass in all versions up to, and including, 2.5.2. This is due to the create_payment_intent() function performing a payment validation
- 7.2 High severity
SureForms – Contact Form, Payment Form & Other…: Improper Neutralization of Input During Web Page Generation
The SureForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form field parameters in all versions up to, and including, 2.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated att
- 8.8 High severity
Starter Templates – AI-Powered Templates for…: Unrestricted Upload of File with Dangerous Type
The Starter Templates plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 4.4.41. This is due to insufficient file type validation detecting WXR files, allowing double extension files to bypass sanitization while b
- 8.1 High severity
SureMail – SMTP and Email Logs Plugin with…: Unrestricted Upload of File with Dangerous Type
The SureMail – SMTP and Email Logs Plugin for WordPress is vulnerable to Unrestricted Upload of File with Dangerous Type in versions up to and including 1.9.0. This is due to the plugin's save_file() function in inc/emails/handler/uploads.php which duplicates
- 7.5 High severity
SureForms – Drag and Drop Form Builder for…: Deserialization of Untrusted Data
The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7.3 via the use of file_exists() in the delete_entry_files() function without restriction on the path pr
- 8.1 High severity
SureForms – Drag and Drop Form Builder for…: Externally Controlled Reference to a Resource in Another Sphere
The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_entry_files() function in all versions up to, and including, 1.7.3. This makes it poss
- 8.1 High severity
OttoKit: All-in-One Automation Platform: Incorrect Comparison
The SureTriggers: All-in-One Automation Platform plugin for WordPress is vulnerable to an authentication bypass leading to administrative account creation due to a missing empty value check on the 'secret_key' value in the 'autheticate_user' function in all ve
- 8.8 High severity
Ultimate Addons for Elementor: Improper Privilege Management
Improper Privilege Management vulnerability in Brainstorm Force Ultimate Addons for Elementor allows Privilege Escalation.This issue affects Ultimate Addons for Elementor: from n/a through 1.36.31.
- 8.8 High severity
Ultimate Addons for Elementor: Improper Privilege Management
Improper Privilege Management vulnerability in Brainstorm Force Ultimate Addons for Elementor allows Privilege Escalation.This issue affects Ultimate Addons for Elementor: from n/a through 1.36.20.
- 8.8 High severity
Spectra Pro: Improper Privilege Management
The Spectra Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.1.5. This is due to the plugin allowing lower-privileged users to create registration forms and set the default role to administrator This makes
- 8.8 High severity
ConvertPlus: Deserialization of Untrusted Data
The ConvertPlug plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.5.25 via deserialization of untrusted input from the 'settings_encoded' attribute of the 'smile_info_bar' shortcode. This makes it possible for a
- 8.8 High severity
Astra Pro: Improper Control of Generation of Code
Improper Control of Generation of Code ('Code Injection') vulnerability in Brainstorm Force Astra Pro.This issue affects Astra Pro: from n/a through 4.3.1.
- 8.8 High severity
CartFlows Pro: Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force US LLC CartFlows Pro allows Cross Site Request Forgery.This issue affects CartFlows Pro: from n/a through 1.11.12.
- 8.8 High severity
Schema Pro: Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force US LLC Schema Pro allows Cross Site Request Forgery.This issue affects Schema Pro: from n/a through 2.7.7.