# cve.now: Brainstormforce

The newest entries naming Brainstormforce as an affected vendor (up to 200), of 62 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-92294](https://cve.now/CVE-2026-92294.md): Spectra Gutenberg Blocks \<= 2.20.4 - Missing Authorization to Unauthenticated Limited Theme File Deletion and Modification via 'page'… (CVSS 6.5)
- [CVE-2026-96870](https://cve.now/CVE-2026-96870.md): SureDash \<= 1.12.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display\_name' Parameter (CVSS 6.4)
- [CVE-2026-102774](https://cve.now/CVE-2026-102774.md): SureDash \<= 1.12.1 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post Content (CVSS 6.4)
- [CVE-2026-16302](https://cve.now/CVE-2026-16302.md): Spectra Legacy – Gutenberg Blocks \<= 2.20.0 - Authenticated (Contributor+) Sensitive Information Exposure (CVSS 4.3)
- [CVE-2026-18406](https://cve.now/CVE-2026-18406.md): SureForms \<= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Text Field Entity-Encoded Payload (CVSS 7.2)
- [CVE-2026-18402](https://cve.now/CVE-2026-18402.md): SureDash \<= 1.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'draweropenverposition' Block/Shortcode Attribute (CVSS 6.4)
- [CVE-2026-7623](https://cve.now/CVE-2026-7623.md): SureForms \<= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'headingWrapper' Block Attribute (CVSS 6.4)
- [CVE-2026-15821](https://cve.now/CVE-2026-15821.md): SureDash \<= 1.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4)
- [CVE-2026-15787](https://cve.now/CVE-2026-15787.md): Ultimate Addons for Elementor \<= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes (CVSS 6.4)
- [CVE-2026-12900](https://cve.now/CVE-2026-12900.md): Spectra Gutenberg Blocks \<= 2.19.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via uagb/image Block (CVSS 6.4)
- [CVE-2026-15288](https://cve.now/CVE-2026-15288.md): SureForms – Drag and Drop Form Builder for WordPress \<= 2.2.1 - Unauthenticated Stripe Payment Amount Manipulation (CVSS 7.5)
- [CVE-2026-7465](https://cve.now/CVE-2026-7465.md): Spectra Gutenberg Blocks \<= 2.19.25 - Authenticated (Contributor+) Remote Code Execution via Arbitrary PHP Function Call via Block Attributes (CVSS 8.8)
- [CVE-2026-9065](https://cve.now/CVE-2026-9065.md): Surecart - SQL Injection (CVSS 9.3)
- [CVE-2026-4987](https://cve.now/CVE-2026-4987.md): SureForms \<= 2.5.2 - Unauthenticated Payment Amount Validation Bypass via 'form\_id' (CVSS 7.5)
- [CVE-2026-3534](https://cve.now/CVE-2026-3534.md): Astra \<= 4.12.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta (CVSS 6.4)
- [CVE-2026-0950](https://cve.now/CVE-2026-0950.md): Spectra Gutenberg Blocks \<= 2.19.17 - Unauthenticated Information Disclosure in Sensitive Data (CVSS 5.3)
- [CVE-2025-14351](https://cve.now/CVE-2025-14351.md): Custom Fonts – Host Your Fonts Locally \<= 2.1.16 - Missing Authorization to Unauthenticated Font Deletion (CVSS 5.3)
- [CVE-2025-14855](https://cve.now/CVE-2025-14855.md): SureForms \<= 2.2.0 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2)
- [CVE-2025-13065](https://cve.now/CVE-2025-13065.md): Starter Templates \<= 4.4.41 - Authenticated (Author+) Arbitrary File Upload via WXR Upload Bypass (CVSS 8.8)
- [CVE-2025-13516](https://cve.now/CVE-2025-13516.md): SureMail – SMTP and Email Logs Plugin with Amazon SES, Postmark, and Other Providers \<= 1.9.0 - Unauthenticated Arbitrary File Upload (CVSS 8.1)
- [CVE-2025-12535](https://cve.now/CVE-2025-12535.md): SureForms \<= 1.13.1 - Cross-Site Request Forgery Protection Bypass via Improper Nonce Distribution (CVSS 5.3)
- [CVE-2025-12536](https://cve.now/CVE-2025-12536.md): SureForms \<= 1.13.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure (CVSS 5.3)
- [CVE-2025-11162](https://cve.now/CVE-2025-11162.md): Spectra \<= 2.19.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom CSS (CVSS 6.4)
- [CVE-2025-10732](https://cve.now/CVE-2025-10732.md): SureForms – Drag and Drop Form Builder for WordPress \<= 1.12.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure (CVSS 4.3)
- [CVE-2025-10489](https://cve.now/CVE-2025-10489.md): SureForms – Drag and Drop Form Builder for WordPress \<= 1.12.0 - Missing Authorization to Authenticated (Contributor+) Form Creation (CVSS 4.3)
- [CVE-2025-8488](https://cve.now/CVE-2025-8488.md): Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) \<= 2.4.6 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update (CVSS 4.3)
- [CVE-2025-6691](https://cve.now/CVE-2025-6691.md): SureForms – Drag and Drop Form Builder for WordPress \<= 1.7.3 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Submission Deletion (CVSS 8.1)
- [CVE-2025-6742](https://cve.now/CVE-2025-6742.md): SureForms – Drag and Drop Form Builder for WordPress \<= 1.7.3 - Unauthenticated PHP Object Injection (PHAR) Triggered via Admin Submission Deletion (CVSS 7.5)
- [CVE-2025-3102](https://cve.now/CVE-2025-3102.md): SureTriggers \<= 1.0.78 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Administrative User Creation (CVSS 8.1)
- [CVE-2025-1784](https://cve.now/CVE-2025-1784.md): Spectra – WordPress Gutenberg Blocks \<= 2.19.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-12713](https://cve.now/CVE-2024-12713.md): SureForms – Drag and Drop Form Builder for WordPress \<= 1.2.2 - Missing Authorization to Unauthenticated Protected Post Disclosure (CVSS 5.3)
- [CVE-2024-11230](https://cve.now/CVE-2024-11230.md): Elementor Header & Footer Builder \<= 1.6.46 - Authenticated (Contributor+) Stored Cross-Site Scripting via Page Title Widget (CVSS 6.4)
- [CVE-2024-10484](https://cve.now/CVE-2024-10484.md): Spectra – WordPress Gutenberg Blocks \<= 2.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Widget (CVSS 6.4)
- [CVE-2024-10325](https://cve.now/CVE-2024-10325.md): Elementor Header & Footer Builder \<= 1.6.45 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4)
- [CVE-2024-10050](https://cve.now/CVE-2024-10050.md): Elementor Header & Footer Builder \<= 1.6.43 - Authenticated (Contributor+) Information Disclosure via Shortcode (CVSS 4.3)
- [CVE-2024-4632](https://cve.now/CVE-2024-4632.md): WooCommerce Checkout & Funnel Builder by CartFlows – Create High Converting Stores For WooCommerce \<= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-5757](https://cve.now/CVE-2024-5757.md): Elementor Header & Footer Builder \<= 1.6.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via Site Title Widget (CVSS 6.4)
- [CVE-2024-5485](https://cve.now/CVE-2024-5485.md): SureTriggers – Connect All Your Plugins, Apps, Tools & Automate Everything! \<= 1.0.46 - Authenticated (Contributor+) Stored Cross-Site Scripting via Trigger Link Shortcode (CVSS 6.4)
- [CVE-2024-4366](https://cve.now/CVE-2024-4366.md): Spectra – WordPress Gutenberg Blocks \<= 2.13.0 - Authenticated (Author+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-1332](https://cve.now/CVE-2024-1332.md): Custom Fonts – Host Your Fonts Locally \<= 2.1.4 - Authenticated (Author+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-2618](https://cve.now/CVE-2024-2618.md): Elementor Header & Footer Builder \<= 1.6.26 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-1814](https://cve.now/CVE-2024-1814.md): Spectra – WordPress Gutenberg Blocks \<= 2.12.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial Block (CVSS 6.4)
- [CVE-2024-1815](https://cve.now/CVE-2024-1815.md): Spectra – WordPress Gutenberg Blocks \<= 2.12.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Gallery Block (CVSS 6.4)
- [CVE-2024-2619](https://cve.now/CVE-2024-2619.md): Elementor Header & Footer Builder \<= 1.6.26 - Authenticated (Author+) HTML Injection (CVSS 5.0)
- [CVE-2024-4634](https://cve.now/CVE-2024-4634.md): Elementor Header & Footer Builder \<= 1.6.28 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-4630](https://cve.now/CVE-2024-4630.md): Starter Templates — Elementor, WordPress & Beaver Builder Templates \<= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-1467](https://cve.now/CVE-2024-1467.md): Starter Templates — Elementor, WordPress & Beaver Builder Templates \<= 4.1.6 - Authenticated (Contributor+) Server-Side Request Forgery (CVSS 4.3)
- [CVE-2024-3107](https://cve.now/CVE-2024-3107.md): Spectra – WordPress Gutenberg Blocks \<= 2.12.6 - Authenticated (Contributor+) Path Traversal (CVSS 4.3)
- [CVE-2024-2347](https://cve.now/CVE-2024-2347.md): Astra \<= 4.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Display Name (CVSS 6.4)
- [CVE-2023-6486](https://cve.now/CVE-2023-6486.md): Spectra – WordPress Gutenberg Blocks \<= 2.10.3 - Authenticated(Contributor+) Cross-Site Scripting via Custom CSS (CVSS 6.4)
- [CVE-2024-2140](https://cve.now/CVE-2024-2140.md): Ultimate Addons for Beaver Builder – Lite \<= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Icons Widget (CVSS 6.4)
- [CVE-2024-2142](https://cve.now/CVE-2024-2142.md): Ultimate Addons for Beaver Builder – Lite \<= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Info Table Widget (CVSS 6.4)
- [CVE-2024-2141](https://cve.now/CVE-2024-2141.md): Ultimate Addons for Beaver Builder – Lite \<= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget (CVSS 6.4)
- [CVE-2024-2144](https://cve.now/CVE-2024-2144.md): Ultimate Addons for Beaver Builder – Lite \<= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Separator Widget (CVSS 6.4)
- [CVE-2024-2143](https://cve.now/CVE-2024-2143.md): Ultimate Addons for Beaver Builder – Lite \<= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading Widget (CVSS 6.4)
- [CVE-2024-1237](https://cve.now/CVE-2024-1237.md): Elementor Header & Footer Builder \<= 1.6.24 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2020-36747](https://cve.now/CVE-2020-36747.md): Lightweight Sidebar Manager \<= 1.1.4 - Cross-Site Request Forgery Bypass (CVSS 4.3)
- [CVE-2020-36737](https://cve.now/CVE-2020-36737.md): Import / Export Customizer Settings \<= 1.0.3 - Cross-Site Request Forgery Bypass (CVSS 4.3)
- [CVE-2020-36736](https://cve.now/CVE-2020-36736.md): WooCommerce Checkout & Funnel Builder by CartFlows – Create High Converting Stores For WooCommerce \<= 1.5.15 - Cross-Site Request Forgery Bypass (CVSS 4.3)
- [CVE-2019-25151](https://cve.now/CVE-2019-25151.md): Funnel Builder \<= 1.3.0 - Arbitrary Plugin Activation (CVSS 5.4)
- [CVE-2020-36702](https://cve.now/CVE-2020-36702.md): Spectra – WordPress Gutenberg Blocks \<= 1.14.7 - Missing Authorization (CVSS 5.5)
- [CVE-2021-42360](https://cve.now/CVE-2021-42360.md): Starter Templates — Elementor, Gutenberg & Beaver Builder Templates \<= 2.7.0 Authenticated Block Import to Stored XSS (CVSS 7.6)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/brainstormforce
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.