# cve.now: Brainstorm Force

The newest entries naming Brainstorm Force as an affected vendor (up to 200), of 103 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-120842](https://cve.now/CVE-2026-120842.md): WordPress SureForms plugin \<= 2.13.0 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-119520](https://cve.now/CVE-2026-119520.md): WordPress Spectra plugin \<= 2.20.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-120853](https://cve.now/CVE-2026-120853.md): WordPress CartFlows plugin \<= 3.3.0 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-120852](https://cve.now/CVE-2026-120852.md): WordPress CartFlows plugin \<= 3.3.0 - Content Injection vulnerability (CVSS 5.3)
- [CVE-2026-115604](https://cve.now/CVE-2026-115604.md): WordPress SureDash plugin \<= 1.12.3 - Arbitrary File Deletion vulnerability (CVSS 5.0)
- [CVE-2026-39739](https://cve.now/CVE-2026-39739.md): WordPress Ultimate Addons for Elementor - Lite plugin \<= 2.9.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-115605](https://cve.now/CVE-2026-115605.md): WordPress SureDash plugin \<= 1.12.3 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-110881](https://cve.now/CVE-2026-110881.md): WordPress SureDash plugin \<= 1.12.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-116387](https://cve.now/CVE-2026-116387.md): WordPress SureForms plugin \<= 2.12.9 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-116402](https://cve.now/CVE-2026-116402.md): WordPress SureForms plugin \<= 2.12.9 - Content Injection vulnerability (CVSS 5.3)
- [CVE-2026-110892](https://cve.now/CVE-2026-110892.md): WordPress SureDash plugin \<= 1.12.2 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-112241](https://cve.now/CVE-2026-112241.md): WordPress SureCart plugin \<= 4.9.5 - Broken Authentication vulnerability (CVSS 9.8)
- [CVE-2026-110893](https://cve.now/CVE-2026-110893.md): WordPress SureDash plugin \<= 1.12.2 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-110894](https://cve.now/CVE-2026-110894.md): WordPress SureDash plugin \<= 1.12.2 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-112221](https://cve.now/CVE-2026-112221.md): WordPress SureCart plugin \<= 4.9.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-112840](https://cve.now/CVE-2026-112840.md): WordPress SureCart plugin \<= 4.9.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-110372](https://cve.now/CVE-2026-110372.md): WordPress OttoKit plugin \<= 1.1.40 - Privilege Escalation vulnerability (CVSS 9.8)
- [CVE-2026-109893](https://cve.now/CVE-2026-109893.md): WordPress Presto Player plugin \<= 4.5.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-105874](https://cve.now/CVE-2026-105874.md): WordPress SureCart plugin \<= 4.9.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-106599](https://cve.now/CVE-2026-106599.md): WordPress SureCart plugin \<= 4.9.3 - PHP Object Injection vulnerability (CVSS 8.8)
- [CVE-2026-109697](https://cve.now/CVE-2026-109697.md): WordPress SureCart plugin \<= 4.9.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-108495](https://cve.now/CVE-2026-108495.md): WordPress SureForms plugin \<= 2.12.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-39721](https://cve.now/CVE-2026-39721.md): WordPress Starter Templates plugin \<= 4.7.7 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2026-102393](https://cve.now/CVE-2026-102393.md): WordPress Starter Templates plugin \<= 4.7.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-102914](https://cve.now/CVE-2026-102914.md): WordPress Presto Player plugin \<= 4.5.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-96837](https://cve.now/CVE-2026-96837.md): WordPress CartFlows plugin \<= 3.2.0 - Remote Code Execution (RCE) vulnerability (CVSS 8.8)
- [CVE-2026-27085](https://cve.now/CVE-2026-27085.md): WordPress Astra WordPress theme theme \<= 4.13.12 - Content Injection vulnerability (CVSS 2.7)
- [CVE-2026-87741](https://cve.now/CVE-2026-87741.md): ConvertPlus \<= 3.6.3 - Authenticated (Subscriber+) PHP Object Injection via 'style' Parameter (CVSS 8.8)
- [CVE-2026-62134](https://cve.now/CVE-2026-62134.md): WordPress Starter Templates plugin \<= 4.7.5 - Insecure Direct Object References (IDOR) vulnerability (CVSS 4.3)
- [CVE-2026-85308](https://cve.now/CVE-2026-85308.md): WordPress SureForms plugin \<= 2.12.5 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3)
- [CVE-2026-80433](https://cve.now/CVE-2026-80433.md): WordPress SureFeedback Client Site plugin \<= 1.2.12 - Sensitive Data Exposure vulnerability (CVSS 7.5)
- [CVE-2026-32553](https://cve.now/CVE-2026-32553.md): WordPress OttoKit plugin \<= 1.1.35 - Server Side Request Forgery (SSRF) vulnerability (CVSS 7.2)
- [CVE-2026-66698](https://cve.now/CVE-2026-66698.md): WordPress SureDash plugin \<= 1.10.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-66688](https://cve.now/CVE-2026-66688.md): WordPress Ultimate Addons for Elementor plugin \<= 1.45.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-57401](https://cve.now/CVE-2026-57401.md): WordPress SureDash plugin \<= 1.8.0 - Arbitrary File Deletion vulnerability (CVSS 9.9)
- [CVE-2026-54813](https://cve.now/CVE-2026-54813.md): WordPress SureDash plugin \<= 1.8.0 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2026-49781](https://cve.now/CVE-2026-49781.md): WordPress OttoKit plugin \<= 1.1.27 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-39470](https://cve.now/CVE-2026-39470.md): WordPress WooCommerce Cart Abandonment Recovery plugin \< 2.1.0 - Privilege Escalation vulnerability (CVSS 7.2)
- [CVE-2026-45442](https://cve.now/CVE-2026-45442.md): WordPress Presto Player plugin \<= 4.1.3 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-42648](https://cve.now/CVE-2026-42648.md): WordPress Spectra plugin \<= 2.19.22 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-42377](https://cve.now/CVE-2026-42377.md): WordPress SureForms Pro plugin \<= 2.8.0 - Broken Access Control vulnerability (CVSS 7.3)
- [CVE-2026-39479](https://cve.now/CVE-2026-39479.md): WordPress OttoKit plugin \<= 1.1.20 - SQL Injection vulnerability (CVSS 7.6)
- [CVE-2026-39477](https://cve.now/CVE-2026-39477.md): WordPress CartFlows plugin \<= 2.2.3 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2026-34889](https://cve.now/CVE-2026-34889.md): WordPress Ultimate Addons for WPBakery Page Builder plugin \< 3.21.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-32431](https://cve.now/CVE-2026-32431.md): WordPress Astra Bulk Edit plugin \<= 1.2.10 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-28038](https://cve.now/CVE-2026-28038.md): WordPress Ultimate Addons for WPBakery Page Builder plugin \<= 3.21.1 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-25316](https://cve.now/CVE-2026-25316.md): WordPress CartFlows plugin \<= 2.1.19 - PHP Object Injection vulnerability (CVSS 7.2)
- [CVE-2026-24982](https://cve.now/CVE-2026-24982.md): WordPress Spectra plugin \<= 2.19.17 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-24962](https://cve.now/CVE-2026-24962.md): WordPress Sigmize plugin \<= 0.0.9 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2025-68497](https://cve.now/CVE-2025-68497.md): WordPress Astra Widgets plugin \<= 1.2.16 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2023-23729](https://cve.now/CVE-2023-23729.md): WordPress Spectra – WordPress Gutenberg Blocks plugin \<= 2.3.0 - Contributor+ reCAPTCHA Settings Change Vulnerability (CVSS 5.4)
- [CVE-2025-62059](https://cve.now/CVE-2025-62059.md): WordPress SureRank plugin \<= 1.3.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-48088](https://cve.now/CVE-2025-48088.md): WordPress Ultimate Addons for WPBakery Page Builder plugin \< 3.21.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-11814](https://cve.now/CVE-2025-11814.md): Ultimate Addons for WPBakery Page Builder \< 3.21.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2025-48164](https://cve.now/CVE-2025-48164.md): WordPress SureDash \<= 1.0.3 - Privilege Escalation Vulnerability (CVSS 8.8)
- [CVE-2025-54685](https://cve.now/CVE-2025-54685.md): WordPress SureDash Plugin \<= 1.1.0 - Sensitive Data Exposure Vulnerability (CVSS 6.5)
- [CVE-2025-27007](https://cve.now/CVE-2025-27007.md): WordPress SureTriggers \<= 1.0.82 - Privilege Escalation Vulnerability (CVSS 9.8)
- [CVE-2024-12434](https://cve.now/CVE-2024-12434.md): SureMembers \<= 1.10.6 - Sensitive Information Exposure (CVSS 5.3)
- [CVE-2024-13800](https://cve.now/CVE-2024-13800.md): Popup Plugin For WordPress - ConvertPlus \<= 3.5.30 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update (CVSS 8.1)
- [CVE-2025-24568](https://cve.now/CVE-2025-24568.md): WordPress Starter Templates plugin \<= 4.4.9 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2024-56274](https://cve.now/CVE-2024-56274.md): WordPress Astra Widgets plugin \<= 1.2.15 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2023-23825](https://cve.now/CVE-2023-23825.md): WordPress Spectra – WordPress Gutenberg Blocks plugin \<= 2.3.0 - Broken Access Control + CSRF on Import\_WPforms vulnerability (CVSS 3.1)
- [CVE-2023-23834](https://cve.now/CVE-2023-23834.md): WordPress Spectra – WordPress Gutenberg Blocks plugin \<= 2.3.0 - Broken Access Control + CSRF on Activate\_Plugin vulnerability (CVSS 4.3)
- [CVE-2024-37517](https://cve.now/CVE-2024-37517.md): WordPress Spectra plugin \<= 2.13.7 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2024-50439](https://cve.now/CVE-2024-50439.md): WordPress Astra Widgets plugin \<= 1.2.14 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-47345](https://cve.now/CVE-2024-47345.md): WordPress Starter Templates plugin \<= 4.4.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2024-43151](https://cve.now/CVE-2024-43151.md): WordPress Ultimate Addons for Beaver Builder – Lite plugin \<= 1.5.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-7590](https://cve.now/CVE-2024-7590.md): WordPress Spectra plugin\<= 2.14.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-3827](https://cve.now/CVE-2024-3827.md): Spectra Pro \<= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block IDs (CVSS 6.4)
- [CVE-2024-5251](https://cve.now/CVE-2024-5251.md): Ultimate Addons for WPBakery Page Builder \<= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
- [CVE-2024-5253](https://cve.now/CVE-2024-5253.md): Ultimate Addons for WPBakery Page Builder \<= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
- [CVE-2024-5252](https://cve.now/CVE-2024-5252.md): Ultimate Addons for WPBakery Page Builder \<= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
- [CVE-2024-5255](https://cve.now/CVE-2024-5255.md): Ultimate Addons for WPBakery Page Builder \<= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
- [CVE-2024-5254](https://cve.now/CVE-2024-5254.md): Ultimate Addons for WPBakery Page Builder \<= 3.19.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
- [CVE-2024-37455](https://cve.now/CVE-2024-37455.md): WordPress Ultimate Addons for elementor plugin \<= 1.36.31 - Privilege Escalation vulnerability (CVSS 8.8)
- [CVE-2023-36676](https://cve.now/CVE-2023-36676.md): WordPress Spectra plugin \<= 2.6.6 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2023-36684](https://cve.now/CVE-2023-36684.md): WordPress Convert Pro plugin \<= 1.7.5 - Broken Access Control vulnerability (CVSS 7.1)
- [CVE-2023-41805](https://cve.now/CVE-2023-41805.md): Broken Access Control vulnerability in multiple Brainstorm Force plugins (CVSS 6.5)
- [CVE-2023-44148](https://cve.now/CVE-2023-44148.md): WordPress Astra Bulk Edit plugin \<= 1.2.7 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2023-44151](https://cve.now/CVE-2023-44151.md): WordPress Pre-Publish Checklist plugin \<= 1.1.1 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2023-51376](https://cve.now/CVE-2023-51376.md): WordPress ProjectHuddle Client Site plugin \<= 1.0.34 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2023-23738](https://cve.now/CVE-2023-23738.md): WordPress Spectra – WordPress Gutenberg Blocks plugin \<= 2.3.0 - Unauthenticated Email Spoofing Vulnerability (CVSS 5.3)
- [CVE-2023-23735](https://cve.now/CVE-2023-23735.md): WordPress Spectra – WordPress Gutenberg Blocks plugin \<= 2.3.0 - Unauthenticated Email HTML Injection Vulnerability (CVSS 5.3)
- [CVE-2023-23730](https://cve.now/CVE-2023-23730.md): WordPress Spectra – WordPress Gutenberg Blocks plugin \<= 2.3.0 - Captcha Bypass Vulnerability (CVSS 5.3)
- [CVE-2023-51401](https://cve.now/CVE-2023-51401.md): WordPress Ultimate Addons for Beaver Builder Premium plugin \<= 1.35.13 - Limited Arbitrary File Download vulnerability (CVSS 6.3)
- [CVE-2023-51398](https://cve.now/CVE-2023-51398.md): WordPress Ultimate Addons for Beaver Builder Premium plugin \<= 1.35.14 - Privilege Escalation vulnerability (CVSS 8.8)
- [CVE-2023-50890](https://cve.now/CVE-2023-50890.md): WordPress Ultimate Addons for Elementor plugin \<= 1.36.20 - Privilege Escalation vulnerability (CVSS 8.8)
- [CVE-2023-46205](https://cve.now/CVE-2023-46205.md): WordPress Ultimate Addons for WPBakery Page Builder plugin \<= 3.19.14 - Local File Inclusion vulnerability (CVSS 7.1)
- [CVE-2024-4838](https://cve.now/CVE-2024-4838.md): ConvertPlus \<= 3.5.26 - Authenticated (Contributor+) PHP Object Injection (CVSS 7.5)
- [CVE-2024-3828](https://cve.now/CVE-2024-3828.md): Spectra Pro \<= 1.1.5 - Authenticated (Author+) Privilege Escalation (CVSS 8.8)
- [CVE-2024-3240](https://cve.now/CVE-2024-3240.md): ConvertPlug \<= 3.5.25 - Authenticated (Contributor+) PHP Object Injection (CVSS 8.8)
- [CVE-2024-3237](https://cve.now/CVE-2024-3237.md): ConvertPlug \<= 3.5.25 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update (CVSS 5.4)
- [CVE-2023-34370](https://cve.now/CVE-2023-34370.md): Server Side Request Forgery (SSRF) vulnerability in Starter Templates plugins (CVSS 7.1)
- [CVE-2023-36679](https://cve.now/CVE-2023-36679.md): WordPress Spectra plugin \<= 2.6.6 - Server Side Request Forgery (SSRF) vulnerability (CVSS 7.1)
- [CVE-2024-29768](https://cve.now/CVE-2024-29768.md): WordPress Astra theme \<= 4.6.4 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2023-23882](https://cve.now/CVE-2023-23882.md): WordPress Ultimate Addons for Beaver Builder – Lite Plugin \<= 1.5.5 is vulnerable to Broken Access Control (CVSS 4.3)
- [CVE-2023-51397](https://cve.now/CVE-2023-51397.md): WordPress WP Remote Site Search Plugin \<= 1.0.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5)
- [CVE-2023-49830](https://cve.now/CVE-2023-49830.md): WordPress Astra Pro Plugin \<= 4.3.1 is vulnerable to Remote Code Execution (RCE) (CVSS 9.9)
- [CVE-2023-49833](https://cve.now/CVE-2023-49833.md): WordPress Spectra Plugin \<= 2.7.9 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5)
- [CVE-2023-41804](https://cve.now/CVE-2023-41804.md): WordPress Starter Templates Plugin \<= 3.2.4 is vulnerable to Server Side Request Forgery (SSRF) (CVSS 7.1)
- [CVE-2023-46211](https://cve.now/CVE-2023-46211.md): WordPress Ultimate Addons for WPBakery Page Builder Plugin \<= 3.19.14 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5)
- [CVE-2023-25058](https://cve.now/CVE-2023-25058.md): WordPress Schema – All In One Schema Rich Snippets Plugin \<= 1.6.5 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3)
- [CVE-2022-46851](https://cve.now/CVE-2022-46851.md): WordPress Starter Templates Plugin \<= 3.1.20 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/brainstorm-force
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.