Log in Start free

BrainStormForce

Products

ProductCVEsExploitedLatest
Spectra Gutenberg Blocks – Website Builder for the Block Editor11–May 30, 2026
Ultimate Addons for Elementor10–Jul 22, 2026
SureForms – Contact Form, Payment Form & Other Custom Form Builder7–Mar 28, 2026
Ultimate Addons for Beaver Builder – Lite5–Mar 30, 2024
SureDash – Community, Courses & Member Dashboard4–Oct 16, 2026
Spectra Legacy – Gutenberg Blocks3–Oct 31, 2026
Starter Templates – AI-Powered Templates for Elementor & Gutenberg3–Dec 6, 2025
Astra2–Mar 11, 2026
CartFlows – Funnel Builder & Checkout Plugin for WooCommerce2–Jun 19, 2024
Custom Fonts – Host Your Fonts Locally2–Jan 20, 2026
OttoKit: All-in-One Automation Platform2–Apr 10, 2025
SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz2–Sep 5, 2026
SureForms – Drag and Drop Form Builder for WordPress2–Jul 9, 2025
Starter Templates — Elementor, Gutenberg & Beaver Builder Templates1–Nov 17, 2021
SureForms – Drag & Drop Contact Form & Form Builder, Payment Form, Survey, Quiz & Calculator1–Jul 10, 2026
Import / Export Customizer Settings1–Jul 1, 2023
SureMail – SMTP and Email Logs Plugin with Amazon SES, Postmark, and Other Providers1–Dec 2, 2025
Surecart1–May 20, 2026
Lightweight Sidebar Manager1–Jul 1, 2023

Exploited and recent CVEs

  • CVE-2026-92294 Medium 6.5 Spectra Gutenberg Blocks <= 2.20.4 - Missing Authorization to Unauthenticated Limited Theme File Deletion and Modification via 'page', 'path', and 'settings' GET Parameters 0.4%
  • CVE-2026-96870 Medium 6.4 SureDash <= 1.12.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter 0.2%
  • CVE-2026-102774 Medium 6.4 SureDash <= 1.12.1 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post Content 0.3%
  • CVE-2026-16302 Medium 4.3 Spectra Legacy – Gutenberg Blocks <= 2.20.0 - Authenticated (Contributor+) Sensitive Information Exposure 0.2%
  • CVE-2026-18406 High 7.2 SureForms <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Text Field Entity-Encoded Payload 0.5%
  • CVE-2026-18402 Medium 6.4 SureDash <= 1.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'draweropenverposition' Block/Shortcode Attribute 0.3%
  • CVE-2026-7623 Medium 6.4 SureForms <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'headingWrapper' Block Attribute 0.4%
  • CVE-2026-15821 Medium 6.4 SureDash <= 1.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes 0.3%
  • CVE-2026-15787 Medium 6.4 Ultimate Addons for Elementor <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes 0.4%
  • CVE-2026-12900 Medium 6.4 Spectra Gutenberg Blocks <= 2.19.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via uagb/image Block 0.3%
  • CVE-2026-15288 High 7.5 SureForms – Drag and Drop Form Builder for WordPress <= 2.2.1 - Unauthenticated Stripe Payment Amount Manipulation 0.5%
  • CVE-2026-7465 High 8.8 Spectra Gutenberg Blocks <= 2.19.25 - Authenticated (Contributor+) Remote Code Execution via Arbitrary PHP Function Call via Block Attributes 1.2%
  • CVE-2026-9065 Critical 9.3 Surecart - SQL Injection 0.3%
  • CVE-2026-4987 High 7.5 SureForms <= 2.5.2 - Unauthenticated Payment Amount Validation Bypass via 'form_id' 1.0%
  • CVE-2026-3534 Medium 6.4 Astra <= 4.12.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta 0.2%
  • CVE-2026-0950 Medium 5.3 Spectra Gutenberg Blocks <= 2.19.17 - Unauthenticated Information Disclosure in Sensitive Data 0.4%
  • CVE-2025-14351 Medium 5.3 Custom Fonts – Host Your Fonts Locally <= 2.1.16 - Missing Authorization to Unauthenticated Font Deletion 0.3%
  • CVE-2025-14855 High 7.2 SureForms <= 2.2.0 - Unauthenticated Stored Cross-Site Scripting 0.4%
  • CVE-2025-13065 High 8.8 Starter Templates <= 4.4.41 - Authenticated (Author+) Arbitrary File Upload via WXR Upload Bypass 14.4%
  • CVE-2025-13516 High 8.1 SureMail – SMTP and Email Logs Plugin with Amazon SES, Postmark, and Other Providers <= 1.9.0 - Unauthenticated Arbitrary File Upload 1.0%
  • CVE-2025-12535 Medium 5.3 SureForms <= 1.13.1 - Cross-Site Request Forgery Protection Bypass via Improper Nonce Distribution 0.2%
  • CVE-2025-12536 Medium 5.3 SureForms <= 1.13.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure 0.8%
  • CVE-2025-11162 Medium 6.4 Spectra <= 2.19.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom CSS 0.2%
  • CVE-2025-10732 Medium 4.3 SureForms – Drag and Drop Form Builder for WordPress <= 1.12.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure 0.3%
  • CVE-2025-10489 Medium 4.3 SureForms – Drag and Drop Form Builder for WordPress <= 1.12.0 - Missing Authorization to Authenticated (Contributor+) Form Creation 0.2%
  • CVE-2025-8488 Medium 4.3 Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) <= 2.4.6 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update 0.3%
  • CVE-2025-6691 High 8.1 SureForms – Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Submission Deletion 1.0%
  • CVE-2025-6742 High 7.5 SureForms – Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated PHP Object Injection (PHAR) Triggered via Admin Submission Deletion 0.6%
  • CVE-2025-3102 High 8.1 SureTriggers <= 1.0.78 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Administrative User Creation 76.2%
  • CVE-2025-1784 Medium 6.4 Spectra – WordPress Gutenberg Blocks <= 2.19.0 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.3%