Skip to content
OpenAdvisories

Product · Brainstorm Force

ConvertPlus

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.8
    CVE-2026-87741

    ConvertPlus <= 3.6.3 - Authenticated (Subscriber+) PHP Object Injection via 'style' Parameter

    The ConvertPlus plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 3.6.3 via the style parameter of the cp_display_preview_modal AJAX action. The vulnerability exists because the action's nonce guard …

    Brainstorm Force ConvertPlus Web / CMS
  • High 8.1
    CVE-2024-13800 Public exploit

    Popup Plugin For WordPress - ConvertPlus <= 3.5.30 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update

    The ConvertPlus plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'cp_dismiss_notice' AJAX endpoint in all versions up to, and including, 3.5.30. This makes it…

    Brainstorm Force ConvertPlus Web / CMS
  • High 7.5
    CVE-2024-4838

    ConvertPlus <= 3.5.26 - Authenticated (Contributor+) PHP Object Injection

    The ConvertPlus plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.5.26 via deserialization of untrusted input from the 'settings_encoded' attribute of the 'smile_modal' shortcode. This makes it possible for aut…

    Brainstorm Force ConvertPlus Web / CMS
  • High 8.8
    CVE-2024-3240

    ConvertPlug <= 3.5.25 - Authenticated (Contributor+) PHP Object Injection

    The ConvertPlug plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.5.25 via deserialization of untrusted input from the 'settings_encoded' attribute of the 'smile_info_bar' shortcode. This makes it possible for …

    Brainstorm Force ConvertPlus Web / CMS