Log in Start free

Brainstorm Force

Products

ProductCVEsExploitedLatest
Spectra13–Nov 7, 2026
SureDash11–Oct 30, 2026
Starter Templates7–Oct 5, 2026
Ultimate Addons for WPBakery6–Oct 16, 2025
SureCart6–Oct 22, 2026
Ultimate Addons for WPBakery Page Builder5–Apr 1, 2026
ConvertPlus5–Sep 28, 2026
OttoKit5–Oct 18, 2026
CartFlows5–Nov 7, 2026
SureForms5–Nov 7, 2026
Ultimate Addons for Elementor3–Aug 6, 2026
Astra Widgets3–Dec 24, 2025
Presto Player3–Oct 15, 2026
Ultimate Addons for Beaver Builder – Lite2–Aug 12, 2024
Astra Bulk Edit2–Mar 13, 2026
Premium Starter Templates2–Jun 19, 2024
Ultimate Addons for Beaver Builder2–May 17, 2024
Starter Templates — Elementor, WordPress & Beaver Builder Templates2–Mar 28, 2024
Spectra Pro2–Aug 2, 2024
WP Remote Site Search1–Dec 29, 2023
Astra Pro1–Dec 29, 2023
Astra WordPress Theme1–Sep 30, 2026
Convert Pro1–Jun 19, 2024
Pre-Publish Checklist1–Jun 19, 2024
ProjectHuddle Client Site1–Jun 14, 2024
Schema – All In One Schema Rich Snippets1–May 26, 2023
Sigmize1–Feb 3, 2026
Spectra – WordPress Gutenberg Blocks1–Dec 14, 2023
SureFeedback Client Site1–Aug 27, 2026
SureForms Pro1–Apr 29, 2026
SureMembers1–Feb 26, 2025
SureRank1–Nov 6, 2025
Ultimate Addons for Elementor - Lite1–Oct 30, 2026
WooCommerce Cart Abandonment Recovery1–Jun 15, 2026
Astra1–Mar 27, 2024

Exploited and recent CVEs

  • CVE-2026-120842 Medium 5.3 WordPress SureForms plugin <= 2.13.0 - Broken Access Control vulnerability –
  • CVE-2026-119520 Medium 6.5 WordPress Spectra plugin <= 2.20.4 - Cross Site Scripting (XSS) vulnerability –
  • CVE-2026-120853 Medium 5.3 WordPress CartFlows plugin <= 3.3.0 - Broken Access Control vulnerability –
  • CVE-2026-120852 Medium 5.3 WordPress CartFlows plugin <= 3.3.0 - Content Injection vulnerability –
  • CVE-2026-115604 Medium 5.0 WordPress SureDash plugin <= 1.12.3 - Arbitrary File Deletion vulnerability 0.4%
  • CVE-2026-39739 Medium 6.5 WordPress Ultimate Addons for Elementor - Lite plugin <= 2.9.5 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-115605 Medium 4.3 WordPress SureDash plugin <= 1.12.3 - Broken Access Control vulnerability 0.2%
  • CVE-2026-110881 Medium 6.5 WordPress SureDash plugin <= 1.12.3 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-116387 Medium 5.3 WordPress SureForms plugin <= 2.12.9 - Broken Access Control vulnerability 0.2%
  • CVE-2026-116402 Medium 5.3 WordPress SureForms plugin <= 2.12.9 - Content Injection vulnerability 0.3%
  • CVE-2026-110892 Medium 6.5 WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability 0.3%
  • CVE-2026-112241 Critical 9.8 WordPress SureCart plugin <= 4.9.5 - Broken Authentication vulnerability 0.5%
  • CVE-2026-110893 Medium 5.3 WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability 0.3%
  • CVE-2026-110894 Medium 5.3 WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability 0.3%
  • CVE-2026-112221 High 7.1 WordPress SureCart plugin <= 4.9.5 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-112840 Medium 6.5 WordPress SureCart plugin <= 4.9.5 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-110372 Critical 9.8 WordPress OttoKit plugin <= 1.1.40 - Privilege Escalation vulnerability 1.4%
  • CVE-2026-109893 Medium 6.5 WordPress Presto Player plugin <= 4.5.3 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-105874 High 7.1 WordPress SureCart plugin <= 4.9.3 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-106599 High 8.8 WordPress SureCart plugin <= 4.9.3 - PHP Object Injection vulnerability 0.4%
  • CVE-2026-109697 Medium 6.5 WordPress SureCart plugin <= 4.9.4 - Cross Site Scripting (XSS) vulnerability 0.1%
  • CVE-2026-108495 Medium 6.5 WordPress SureForms plugin <= 2.12.7 - Cross Site Scripting (XSS) vulnerability 0.1%
  • CVE-2026-39721 Medium 5.4 WordPress Starter Templates plugin <= 4.7.7 - Broken Access Control vulnerability 0.2%
  • CVE-2026-102393 Medium 6.5 WordPress Starter Templates plugin <= 4.7.7 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-102914 Medium 6.5 WordPress Presto Player plugin <= 4.5.2 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-96837 High 8.8 WordPress CartFlows plugin <= 3.2.0 - Remote Code Execution (RCE) vulnerability 0.5%
  • CVE-2026-27085 Low 2.7 WordPress Astra WordPress theme theme <= 4.13.12 - Content Injection vulnerability 0.2%
  • CVE-2026-87741 High 8.8 ConvertPlus <= 3.6.3 - Authenticated (Subscriber+) PHP Object Injection via 'style' Parameter 0.4%
  • CVE-2026-62134 Medium 4.3 WordPress Starter Templates plugin <= 4.7.5 - Insecure Direct Object References (IDOR) vulnerability 0.3%
  • CVE-2026-85308 Medium 5.3 WordPress SureForms plugin <= 2.12.5 - Insecure Direct Object References (IDOR) vulnerability 0.3%