PatchTheCVE: brainstormforce

CVE-2025-5921: The SureForms WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it bac

Wed, 17 Jun 2026 09:49:02 +0000

MEDIUM 5.8: The SureForms WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against both authenticated and unauthenticated users.

CVE-2025-6742: The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to PHP Object Inje

Wed, 17 Jun 2026 10:02:29 +0000

HIGH 7.5: The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7.3 via the use of file_exists() in the delete_entry_files() function without restriction on the path provided. This makes it possible for unaut

CVE-2025-6691: The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file

Wed, 17 Jun 2026 10:02:23 +0000

HIGH 8.1: The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_entry_files() function in all versions up to, and including, 1.7.3. This makes it possible for unauthenticated attackers to de

CVE-2025-3514: The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which cou

Wed, 17 Jun 2026 09:20:05 +0000

LOW 3.5: The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

CVE-2025-3513: The SureForms WordPress plugin before 1.4.4 does not sanitise and escape some of its Form settings, which cou

Wed, 17 Jun 2026 09:20:05 +0000

CVE-2025-3471: The SureForms WordPress plugin before 1.4.4 does not have proper authorisation check when updating its settin

Wed, 17 Jun 2026 09:20:00 +0000

MEDIUM 4.9: The SureForms WordPress plugin before 1.4.4 does not have proper authorisation check when updating its settings via the REST API, which could allow Contributor and above roles to perform such action

CVE-2024-12713: The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Information Exp

Wed, 17 Jun 2026 07:00:19 +0000

MEDIUM 5.3: The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.2 via the handle_export_form() function due to a missing capability check. This makes it possible for unauthenticated attackers to export data

CVE-2024-56274: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainsto

Wed, 17 Jun 2026 08:11:57 +0000

MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Astra Widgets astra-widgets allows Stored XSS.This issue affects Astra Widgets: from n/a through <= 1.2.15.

CVE-2024-11230: The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th

Wed, 17 Jun 2026 06:57:21 +0000

MEDIUM 6.4: The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘size’ parameter in all versions up to, and including, 1.6.46 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contribut

CVE-2023-23834: Missing Authorization vulnerability in Brainstorm Force Spectra allows Exploiting Incorrectly Configured Acces

Wed, 17 Jun 2026 05:38:04 +0000

MEDIUM 4.3: Missing Authorization vulnerability in Brainstorm Force Spectra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through 2.3.0.

CVE-2023-23825: Missing Authorization vulnerability in Brainstorm Force Spectra allows Exploiting Incorrectly Configured Acces

Wed, 17 Jun 2026 05:38:03 +0000

LOW 3.1: Missing Authorization vulnerability in Brainstorm Force Spectra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through 2.3.0.

CVE-2024-10484: The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via

Wed, 17 Jun 2026 06:55:46 +0000

MEDIUM 6.4: The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Team' widget in all versions up to, and including, 2.16.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for au

CVE-2024-10325: The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via RE

Wed, 17 Jun 2026 06:55:25 +0000

MEDIUM 6.4: The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 1.6.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Auth

CVE-2024-37517: Missing Authorization vulnerability in Brainstorm Force Spectra allows Exploiting Incorrectly Configured Acces

Wed, 17 Jun 2026 07:38:32 +0000

MEDIUM 4.3: Missing Authorization vulnerability in Brainstorm Force Spectra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through 2.13.7.

CVE-2024-50439: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainsto

Wed, 17 Jun 2026 08:04:28 +0000

CVE-2024-10050: The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Information Disclosure in all vers

Wed, 17 Jun 2026 06:54:50 +0000

MEDIUM 4.3: The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 1.6.43 via the hfe_template shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to view the contents of Draft,

CVE-2024-7590: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainsto

Wed, 17 Jun 2026 08:20:30 +0000

MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows DOM-Based XSS.This issue affects Spectra: from n/a through <= 2.14.1.

CVE-2024-43151: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in B

Wed, 17 Jun 2026 07:50:31 +0000

MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Brainstorm Force Ultimate Addons for Beaver Builder – Lite allows Stored XSS.This issue affects Ultimate Addons for Beaver Builder – Lite: from n/a through 1.5.9.

CVE-2024-33933: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in B

Wed, 17 Jun 2026 07:32:35 +0000

MEDIUM 6.5: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Brainstorm Force, Nikhil Chavan Elementor – Header, Footer & Blocks Template allows DOM-Based XSS.This issue affects Elementor – Header, Footer & Blocks Template: from n/a through 1.6.35.

CVE-2024-37278: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in P

Wed, 17 Jun 2026 07:38:03 +0000

MEDIUM 5.9: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Pratik Chaskar Cards for Beaver Builder.This issue affects Cards for Beaver Builder: from n/a through 1.1.4.

CVE-2024-5255: The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plu