Skip to content
OpenAdvisories

Vendor

Brainstorm Force

170 known vulnerabilities.

Products

Ultimate Addons for Elementor 13 Spectra 13 Spectra Gutenberg Blocks – Website Builder for the Block Editor 11 SureDash 11 SureCart 8 Ultimate Addons for Beaver Builder – Lite 7 SureForms – Contact Form, Payment Form & Other Custom Form Builder 7 Starter Templates 7 SureForms 6 Ultimate Addons for WPBakery Page Builder 6 Ultimate Addons for WPBakery 6 OttoKit 5 CartFlows 5 ConvertPlus 5 SureDash – Community, Courses & Member Dashboard 5 Spectra Legacy – Gutenberg Blocks 3 Astra 3 CartFlows – Funnel Builder & Checkout Plugin for WooCommerce 3 Starter Templates – AI-Powered Templates for Elementor & Gutenberg 3 Astra Widgets 3 Presto Player 3 Astra Bulk Edit 2 SureForms – Drag and Drop Form Builder for WordPress 2 Premium Starter Templates 2 Starter Templates — Elementor, WordPress & Beaver Builder Templates 2 Spectra Pro 2 SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz 2 Custom Fonts – Host Your Fonts Locally 2 SureRank 2 Ultimate Addons for Beaver Builder 2 OttoKit: All-in-One Automation Platform 2 Ultimate Addons for Elementor - Lite 1 ProjectHuddle Client Site 1 Starter Templates — Elementor, Gutenberg & Beaver Builder Templates 1 SureMembers 1 Sigmize 1 Astra Pro 1 SureFeedback Client Site 1 SureMail – SMTP and Email Logs Plugin with Amazon SES, Postmark, and Other Providers 1 SureForms Pro 1
All Critical High Medium Low Exploited only Public exploit

170 results · Feed

  • High 7.1
    CVE-2023-41804

    WordPress Starter Templates Plugin <= 3.2.4 is vulnerable to Server Side Request Forgery (SSRF)

    Server-Side Request Forgery (SSRF) vulnerability in Brainstorm Force Starter Templates — Elementor, WordPress & Beaver Builder Templates.This issue affects Starter Templates — Elementor, WordPress & Beaver Builder Templates: from n/a through 3.2.4.

    Brainstorm Force Starter Templates — Elementor, WordPress & Beaver Builder Templates Web / CMS
  • Medium 6.5
    CVE-2023-46211

    WordPress Ultimate Addons for WPBakery Page Builder Plugin <= 3.19.14 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Brainstorm Force Ultimate Addons for WPBakery Page Builder plugin <= 3.19.14 versions.

    Brainstorm Force Ultimate Addons for WPBakery Page Builder
  • Medium 4.3
    CVE-2020-36747

    Lightweight Sidebar Manager <= 1.1.4 - Cross-Site Request Forgery Bypass

    The Lightweight Sidebar Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.4. This is due to missing or incorrect nonce validation on the metabox_save() function. This makes it possible for unauthent…

    Brainstorm Force Lightweight Sidebar Manager Web / CMS
  • Medium 4.3
    CVE-2020-36737

    Import / Export Customizer Settings <= 1.0.3 - Cross-Site Request Forgery Bypass

    The Import / Export Customizer Settings plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.3. This is due to missing or incorrect nonce validation on the astra_admin_errors() function. This makes it possible…

    Brainstorm Force Import / Export Customizer Settings Web / CMS
  • Medium 4.3
    CVE-2020-36736

    WooCommerce Checkout & Funnel Builder by CartFlows – Create High Converting Stores For WooCommerce <= 1.5.15 - Cross-Site Request Forgery Bypass

    The WooCommerce Checkout & Funnel Builder by CartFlows plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.15. This is due to missing or incorrect nonce validation on the export_json, import_json, and status_…

    Brainstorm Force CartFlows – Funnel Builder & Checkout Plugin for WooCommerce Web / CMS
  • Medium 5.4
    CVE-2019-25151

    Funnel Builder <= 1.3.0 - Arbitrary Plugin Activation

    The Funnel Builder plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the activate_plugin function in versions up to, and including, 1.3.0. This makes it possible for authenticated attackers to activate any plugin …

    Brainstorm Force CartFlows – Funnel Builder & Checkout Plugin for WooCommerce Web / CMS
  • Medium 5.5
    CVE-2020-36702

    Spectra – WordPress Gutenberg Blocks <= 1.14.7 - Missing Authorization

    The Ultimate Addons for Gutenberg plugin for WordPress is vulnerable to Authenticated Settings Change in versions up to, and including, 1.14.7. This is due to missing capability checks on several AJAX actions. This makes it possible for authenticated attacker…

    Brainstorm Force Spectra Gutenberg Blocks – Website Builder for the Block Editor Web / CMS
  • Medium 4.3
    CVE-2023-25058

    WordPress Schema – All In One Schema Rich Snippets Plugin <= 1.6.5 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force Schema – All In One Schema Rich Snippets plugin <= 1.6.5 versions.

    Brainstorm Force Schema – All In One Schema Rich Snippets
  • Medium 4.3
    CVE-2022-46851

    WordPress Starter Templates Plugin <= 3.1.20 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force Starter Templates plugin <= 3.1.20 versions.

    Brainstorm Force Starter Templates
  • High 7.6
    CVE-2021-42360

    Starter Templates — Elementor, Gutenberg & Beaver Builder Templates <= 2.7.0 Authenticated Block Import to Stored XSS

    On sites that also had the Elementor plugin for WordPress installed, it was possible for users with the edit_posts capability, which includes Contributor-level users, to import blocks onto any page using the astra-page-elementor-batch-process AJAX action. An …

    Brainstorm Force Starter Templates — Elementor, Gutenberg & Beaver Builder Templates Web / CMS