Brainstorm Force
Monthly
Authentication bypass by spoofing in Brainstorm Force's SureCart WordPress plugin affects versions through 4.9.5 and, per the CVSS vector, is reachable over the network without authentication or user interaction, with high confidentiality, integrity, and availability impact. The exact spoofing mechanism and any required configuration are not described in the supplied sources, and no public exploit was identified at time of analysis. The vuln.today priority is act_now.
Stored cross-site scripting in the SureCart WordPress plugin through 4.9.5 lets an authenticated attacker persist malicious script that runs when a victim renders the affected content, enabling browser-session actions under the victim's privileges. The issue is rated CVSS 7.1 High with UI:R and scope change; no public exploit code or CISA KEV confirmation is present in the provided intelligence.
Reflected cross-site scripting in the Brainstorm Force SureCart WordPress e-commerce plugin (all versions through 4.9.3) allows an unauthenticated attacker to run arbitrary JavaScript in the browser of a logged-in SureCart/WordPress user - typically a store administrator or operator - by delivering a crafted URL containing the payload (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Because the flaw is purely reflected there is no persistence: every victim must be individually lured into clicking the malicious link while authenticated, and no public exploit code for this CVE has been identified at time of analysis and it is not confirmed actively exploited (CISA KEV). Independent assessment rates this a moderate-risk, not top-priority, issue, with the mandatory user interaction (UI:R) being the main factor limiting realistic exploitation compared with a no-interaction bug.
PHP object injection in the Brainstorm Force SureCart WordPress plugin (all versions through 4.9.3) lets a low-privilege authenticated attacker supply untrusted serialized data that the plugin deserializes, enabling arbitrary object instantiation and, where a usable gadget chain exists in the plugin or its dependencies, escalation to code execution or full site compromise. The CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N and High confidentiality, integrity, and availability impact, and no user interaction is required; exploitation still depends on reaching the specific vulnerable deserialization endpoint and on the presence of a suitable gadget chain. No public exploit code was identified at time of analysis, and the CVE is not confirmed as actively exploited (CISA KEV).
Remote code execution in the CartFlows WordPress plugin affects versions 3.2.0 and earlier, allowing an authenticated user with Contributor role or higher to execute arbitrary code on the hosting server. The flaw is a PHP include/require path-control weakness (CWE-98) with a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation requires a valid low-privileged account but no user interaction. No public exploit was identified at time of analysis, and the practical exposure depends on whether the site grants Contributor access to untrusted users.
Unauthenticated sensitive data exposure in the SureFeedback Client Site WordPress plugin (≤1.2.12) permits remote attackers to retrieve subscriber-level confidential data without any credentials. The root cause is CWE-862 (Missing Authorization), meaning the plugin exposes data endpoints that fail to enforce access control checks before returning sensitive subscriber information. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis, but the CVSS:3.1 score of 7.5 with PR:N and AV:N reflects that the attack surface is fully accessible to unauthenticated internet-facing requests.
Unauthenticated SSRF in OttoKit WordPress plugin (≤1.1.35) allows any remote attacker without credentials to coerce the host server into making arbitrary outbound HTTP requests to attacker-controlled targets, including internal network resources and cloud metadata endpoints. The CVSS S:C (Scope Changed) rating confirms the vulnerability crosses security boundaries beyond the WordPress instance itself, enabling internal network reconnaissance, credential harvesting from cloud metadata services (e.g., AWS IMDSv1), or interaction with internal APIs. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.
Unauthenticated cross-site scripting in SureDash (WordPress plugin by Brainstorm Force) through version 1.10.1 enables remote attackers to inject and execute arbitrary JavaScript in a victim's browser without any prior authentication. The vulnerability carries a CVSS 3.1 score of 7.1 with a confirmed scope change (S:C), meaning the malicious script runs in the browser's security context, potentially reaching session tokens, credentials, or other sensitive data beyond the plugin itself. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and zero authentication requirement make this straightforward to exploit once a victim is lured to a crafted URL.
Arbitrary file deletion via path traversal in the SureDash WordPress plugin (Brainstorm Force) affects all versions up to and including 1.8.0, allowing an authenticated low-privilege user to delete files outside the plugin's intended directory by supplying crafted pathnames. The Patchstack reference explicitly characterizes the flaw as arbitrary file deletion, meaning an attacker can remove critical files such as wp-config.php to disrupt the site or force a re-installation takeover. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the CVSS 9.9 rating reflects the low barrier to exploitation.
Blind SQL injection in Brainstorm Force SureDash WordPress plugin versions up to and including 1.8.0 allows authenticated low-privileged attackers to inject arbitrary SQL commands through unsanitized input. The scope-changed CVSS 8.5 score reflects that exploitation can impact resources beyond the vulnerable component, exposing sensitive WordPress database contents to remote attackers. No public exploit identified at time of analysis.
Unauthenticated PHP Object Injection in the OttoKit WordPress plugin (formerly SureTriggers) versions 1.1.27 and earlier allows remote attackers to deserialize attacker-controlled PHP objects against any site running the plugin. With a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and a CWE-502 deserialization root cause, successful exploitation can lead to full code execution, data theft, or site takeover when a suitable POP gadget chain is present in WordPress core or another installed plugin. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.
Privilege escalation in the WooCommerce Cart Abandonment Recovery WordPress plugin before version 2.1.0 allows an authenticated shop manager to elevate privileges beyond their intended role on affected WordPress sites. The flaw, tracked as CWE-266 (Incorrect Privilege Assignment), carries a CVSS 7.2 (High) score and has a vendor-released patch in 2.1.0, with no public exploit identified at time of analysis.
Broken access control in the SureForms Pro WordPress form-builder plugin (versions up to and including 2.8.0) lets remote unauthenticated attackers reach functionality that should be protected by capability checks, resulting in limited confidentiality, integrity, and availability impact. The flaw stems from missing authorization (CWE-862) on incorrectly configured access-control security levels rather than a memory-safety or injection bug. EPSS is very low (0.01%, 2nd percentile) and there is no public exploit identified at time of analysis, though SSVC rates the flaw as automatable with partial technical impact.
Blind SQL injection in Brainstorm Force OttoKit (WordPress plugin suretriggers) versions up to 1.1.20 allows privileged attackers with high-level administrative access to extract sensitive database information and potentially cause service disruptions. CVSS 7.6 severity driven by changed scope (container escape to underlying WordPress database). EPSS score of 0.02% (6th percentile) indicates very low observed exploitation probability. No public exploit identified at time of analysis, and no CISA KEV listing confirms active exploitation.
Arbitrary file deletion in the SureDash WordPress plugin through version 1.12.3 allows an authenticated low-privilege user, such as a Subscriber, to delete files on the hosting server via a path traversal flaw (CWE-22). The impact is limited to integrity and availability (CVSS 5.0; assessed vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L), with the main barrier being the need for a valid account, a barrier that open subscriber registration can effectively remove. No CISA KEV entry and no public exploit were identified at time of analysis; this is a moderate, this-month priority rather than an emergency.
Stored cross-site scripting (CWE-79) in the Ultimate Addons for Elementor - Lite plugin (slug header-footer-elementor) affects every release through 2.9.5. An authenticated WordPress user who holds enough privilege to save content into the affected plugin fields can persist a script payload that later executes in the browser of another user who loads the page or screen rendering it, giving a scope-changed (S:C) impact rated 6.5 under CVSS 3.1. The flaw requires an account (PR:L) and victim interaction (UI:R); it is not listed in CISA KEV and no public exploit was identified at time of analysis, so it should be handled as a routine, prioritized patch within the current monthly cycle rather than an emergency.
Missing authorization in the Brainstorm Force SureDash WordPress plugin through 1.12.3 lets an authenticated low-privileged user bypass intended access controls on SureDash functionality or data, with confidentiality-only impact. The CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) reflects the need for a valid account and the absence of integrity or availability effects, and the available signals place remediation in the this_month priority band rather than an emergency. No CISA KEV entry or public exploit code is associated with this CVE in the supplied data, and no public exploit was identified at time of analysis.
Stored cross-site scripting in the Brainstorm Force SureDash WordPress plugin affects versions through 1.12.3; an authenticated low-privilege user can store malicious input that executes when a separate victim loads the affected page. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (medium severity), Patchstack reported the flaw, and no public exploit was identified at time of analysis. The vuln.today priority is this_month.
Missing authorization in the Brainstorm Force SureForms WordPress plugin through 2.12.9 allows unauthenticated remote attackers to perform a privileged action that the plugin's incorrectly configured access-control check fails to restrict, with limited integrity impact and no confidentiality or availability effect. The flaw is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) and affects releases from the earliest version through 2.12.9. No public exploit was identified at time of analysis, and the precise vulnerable endpoint or configuration trigger is not described in the available sources.
Brainstorm Force SureDash through 1.12.2 does not enforce authorization for low-privileged users, allowing an authenticated WordPress account to read data intended for higher-privileged roles; the issue is scored CVSS 6.5 with confidentiality-only impact. The flaw is CWE-862 missing authorization, and no public exploit was identified at time of analysis. Sites that allow untrusted user registration have the larger exposure because a low-privileged account is the prerequisite.
Missing authorization in the Brainstorm Force SureDash WordPress plugin through 1.12.2 allows unauthenticated, network-based attackers to reach functionality that should require access checks, with low confidentiality impact and no integrity or availability impact under the assessed CVSS vector. The vulnerable endpoint and protected resource are not described in the available sources, so default-configuration exploitability cannot be confirmed, and realistic impact depends on the site's SureDash access-level configuration. No public exploit identified at time of analysis and no CISA KEV entry is present; the priority is this_month, consistent with a moderate, not emergency-level, issue.
SureDash WordPress plugin through 1.12.2 contains a missing authorization flaw (CWE-862) that can expose low-sensitivity information to unauthenticated remote attackers. The Patchstack description ties exploitation to incorrectly configured access-control security levels, but the specific endpoint and whether a non-default access-level configuration is required are not specified in the supplied sources; impact is limited to confidentiality with no integrity or availability effect. No public exploit was identified at time of analysis, and the issue is assessed as moderate severity and low priority (decision label: this_month).
Stored cross-site scripting in the Brainstorm Force SureCart WordPress plugin (all versions through 4.9.5) allows an authenticated low-privileged user to persist a script payload that later executes in a higher-privileged administrator's browser when the affected page is viewed, matching CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (6.5). Because exploitation requires both a foothold account capable of submitting the stored data and victim interaction, the practical risk is bounded rather than a self-propagating compromise, and the scope change (S:C) means the payload executes in the administrator's session context rather than the attacker's. No public exploit code and no CISA KEV entry were identified at time of analysis, and the available data does not identify a fixed SureCart release, so sites on 4.9.5 or earlier should be treated as unpatched pending confirmation from the Patchstack advisory.
Stored cross-site scripting in the Brainstorm Force Presto Player WordPress plugin, affecting all versions through 4.5.3, allows an authenticated user with low-level content privileges to persist malicious JavaScript that executes in the browser of any other user who views the affected page. Successful exploitation requires a victim to interact with the crafted content (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, score 6.5), so it is a two-actor, stored attack rather than a direct unauthenticated compromise; the scope change (S:C) reflects that script executes in the context of the victim's session rather than the attacker's. No public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS data was not provided, so the near-term risk is moderate and driven primarily by the large installed base of the plugin.
Stored cross-site scripting in the SureCart WordPress plugin (Brainstorm Force / SureCart) through version 4.9.4 allows a low-privilege authenticated user to persist malicious JavaScript into plugin-rendered content, which then executes in the browser of any user who views the affected page. Rated CVSS 6.5 (medium), the flaw is remote and network-reachable (AV:N) but tempered by two prerequisites: an attacker must first hold a valid low-privilege account (PR:L), and a victim - typically a site administrator or another authenticated user - must load the poisoned page for the payload to fire (UI:R). No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, so this appears to be a coordinated disclosure via Patchstack rather than a defect under active exploitation; exposure is highest on sites that allow untrusted visitors to self-register customer or contributor accounts.
Stored cross-site scripting in the Brainstorm Force SureForms WordPress plugin (all versions through 2.12.7) allows an authenticated low-privileged user to inject script payloads through form fields that execute when a higher-privileged user, typically an administrator, later views the stored submission. Rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), the flaw requires an existing submission-capable account plus victim-driven user interaction, so it is not remotely exploitable without authentication. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Missing authorization checks in the Starter Templates (astra-sites) WordPress plugin, affecting versions through 4.7.7, allow a remote attacker holding a low-privilege account on the target site - such as a subscriber where open registration is enabled - to trigger plugin functionality that should be restricted to higher-privileged roles, resulting in low-level integrity and availability impact with no confidentiality loss (CVSS 5.4). The flaw is a CWE-862 incorrectly configured access-control level, requiring no user interaction and no special complexity, but it cannot be reached by a fully unauthenticated visitor (CVSS vector PR:L). At the time of analysis there is no public exploit identified and no indication of confirmed active exploitation, so risk is driven primarily by the population of sites running the plugin with open or loosely controlled user registration.
Stored cross-site scripting in the Brainstorm Force Starter Templates (astra-sites) WordPress plugin, affecting all versions through 4.7.7, allows an authenticated user with only low-level privileges to plant persistent JavaScript that executes in the browser of a higher-privileged user (such as an administrator or editor) who later views the affected page. Rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), exploitation consumes a valid low-privilege account plus victim interaction, so it is not remote-unauthenticated and the realistic attacker population is limited to sites that permit untrusted registration or loose role assignment. There is no CISA KEV listing and no public exploit code identified at time of analysis; risk is moderate and warrants routine rather than emergency patching.
Stored cross-site scripting in the Presto Player WordPress plugin (Brainstorm Force) through version 4.5.2 lets an authenticated attacker with at least low-level content-contribution privileges save a malicious payload into a Presto Player field, which then executes in the browser of any user who views the affected page. Because the assessed vector is PR:L/UI:R with a scope change (S:C), the attacker cannot be fully anonymous and the impact depends on a second, potentially privileged victim loading the stored content, which is why this is rated medium severity at CVSS 6.5. There is no public exploit identified at time of analysis and no confirmed active exploitation; the only public reference is the Patchstack advisory.
Content injection in Astra WordPress Theme 4.13.12 and earlier allows an authenticated WooCommerce Shop Manager to insert untrusted markup or script content into affected pages. The flaw is network-reachable and low-complexity but requires high privileges and an active WooCommerce installation, yielding only limited integrity impact with no confidentiality or availability loss; CVSS is 2.7. No public exploit identified at time of analysis, and it is not confirmed actively exploited (CISA KEV).
Contributor-level Insecure Direct Object Reference (IDOR) in the Starter Templates WordPress plugin (≤4.7.5) permits authenticated low-privilege users to manipulate object identifiers in plugin requests, modifying resources outside their authorized scope. Reported by Patchstack with a CVSS 4.3, the flaw is bounded to integrity-only impact - no data disclosure or availability disruption applies. No public exploit code and no active exploitation via CISA KEV have been identified at time of analysis.
Unauthenticated information disclosure in SureForms (WordPress form-builder plugin by Brainstorm Force) versions through 2.12.5 allows remote attackers to access restricted data by manipulating user-controlled object identifiers. The root cause is CWE-639 - Authorization Bypass Through User-Controlled Key - a classic IDOR pattern in which the plugin returns object-level data without verifying that the caller has rights to the requested record. Reported by Patchstack; no active exploitation or public proof-of-concept has been identified at time of analysis.
Stored Cross-Site Scripting in the Ultimate Addons for Elementor WordPress plugin (versions <= 1.45.2) allows authenticated contributors to inject persistent malicious scripts that execute in the browsers of higher-privileged users such as site administrators. The CVSS vector (PR:L/UI:R/S:C) confirms this is a contributor-level stored XSS with scope change - a low-privilege WordPress role can trigger execution in an admin's browsing context, enabling session hijacking or privilege escalation. No public exploit or KEV listing has been identified at time of analysis, but Patchstack has formally reported and documented this vulnerability.
Broken access control in Brainstorm Force's Presto Player WordPress plugin (through version 4.1.3) allows authenticated low-privilege users to bypass authorization checks and read restricted data. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms this is network-exploitable by any authenticated WordPress user with no interaction required, though impact is limited to low confidentiality exposure with no integrity or availability consequences. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Missing authorization checks in the Spectra (ultimate-addons-for-gutenberg) WordPress plugin by Brainstorm Force allow authenticated low-privileged users to access restricted functionality or data beyond their intended permission level. All versions through 2.19.22 are affected, and the CVSS vector (PR:L, C:L) confirms that exploitation requires an existing authenticated session and yields only limited confidentiality exposure. No public exploit code exists and SSVC classifies exploitation status as none, making this a low-urgency but actionable remediation target for WordPress sites with open user registration.
Missing authorization in Brainstorm Force CartFlows WordPress plugin versions up to 2.2.3 allows authenticated attackers to modify data through incorrectly configured access control, enabling unauthorized changes to plugin settings or resources. CVSS 4.3 (low severity) with EPSS 0.02% indicates limited real-world exploitation probability; the vulnerability requires prior authentication and does not enable code execution or confidentiality breaches.
A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the Brainstorm Force Astra Bulk Edit WordPress plugin through version 1.2.10, allowing authenticated attackers to inject malicious scripts that execute in the context of other users' browsers. An attacker with low-privilege account access (e.g., contributor or editor role) can craft malicious input that, when processed by the bulk edit functionality, results in arbitrary JavaScript execution affecting site administrators and other users. The vulnerability requires user interaction (UI:R) but can affect multiple users across the site due to its stored/DOM-based nature, making it a persistent attack vector for privilege escalation or data exfiltration.
Authentication bypass by spoofing in Brainstorm Force's SureCart WordPress plugin affects versions through 4.9.5 and, per the CVSS vector, is reachable over the network without authentication or user interaction, with high confidentiality, integrity, and availability impact. The exact spoofing mechanism and any required configuration are not described in the supplied sources, and no public exploit was identified at time of analysis. The vuln.today priority is act_now.
Stored cross-site scripting in the SureCart WordPress plugin through 4.9.5 lets an authenticated attacker persist malicious script that runs when a victim renders the affected content, enabling browser-session actions under the victim's privileges. The issue is rated CVSS 7.1 High with UI:R and scope change; no public exploit code or CISA KEV confirmation is present in the provided intelligence.
Reflected cross-site scripting in the Brainstorm Force SureCart WordPress e-commerce plugin (all versions through 4.9.3) allows an unauthenticated attacker to run arbitrary JavaScript in the browser of a logged-in SureCart/WordPress user - typically a store administrator or operator - by delivering a crafted URL containing the payload (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Because the flaw is purely reflected there is no persistence: every victim must be individually lured into clicking the malicious link while authenticated, and no public exploit code for this CVE has been identified at time of analysis and it is not confirmed actively exploited (CISA KEV). Independent assessment rates this a moderate-risk, not top-priority, issue, with the mandatory user interaction (UI:R) being the main factor limiting realistic exploitation compared with a no-interaction bug.
PHP object injection in the Brainstorm Force SureCart WordPress plugin (all versions through 4.9.3) lets a low-privilege authenticated attacker supply untrusted serialized data that the plugin deserializes, enabling arbitrary object instantiation and, where a usable gadget chain exists in the plugin or its dependencies, escalation to code execution or full site compromise. The CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N and High confidentiality, integrity, and availability impact, and no user interaction is required; exploitation still depends on reaching the specific vulnerable deserialization endpoint and on the presence of a suitable gadget chain. No public exploit code was identified at time of analysis, and the CVE is not confirmed as actively exploited (CISA KEV).
Remote code execution in the CartFlows WordPress plugin affects versions 3.2.0 and earlier, allowing an authenticated user with Contributor role or higher to execute arbitrary code on the hosting server. The flaw is a PHP include/require path-control weakness (CWE-98) with a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation requires a valid low-privileged account but no user interaction. No public exploit was identified at time of analysis, and the practical exposure depends on whether the site grants Contributor access to untrusted users.
Unauthenticated sensitive data exposure in the SureFeedback Client Site WordPress plugin (≤1.2.12) permits remote attackers to retrieve subscriber-level confidential data without any credentials. The root cause is CWE-862 (Missing Authorization), meaning the plugin exposes data endpoints that fail to enforce access control checks before returning sensitive subscriber information. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis, but the CVSS:3.1 score of 7.5 with PR:N and AV:N reflects that the attack surface is fully accessible to unauthenticated internet-facing requests.
Unauthenticated SSRF in OttoKit WordPress plugin (≤1.1.35) allows any remote attacker without credentials to coerce the host server into making arbitrary outbound HTTP requests to attacker-controlled targets, including internal network resources and cloud metadata endpoints. The CVSS S:C (Scope Changed) rating confirms the vulnerability crosses security boundaries beyond the WordPress instance itself, enabling internal network reconnaissance, credential harvesting from cloud metadata services (e.g., AWS IMDSv1), or interaction with internal APIs. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.
Unauthenticated cross-site scripting in SureDash (WordPress plugin by Brainstorm Force) through version 1.10.1 enables remote attackers to inject and execute arbitrary JavaScript in a victim's browser without any prior authentication. The vulnerability carries a CVSS 3.1 score of 7.1 with a confirmed scope change (S:C), meaning the malicious script runs in the browser's security context, potentially reaching session tokens, credentials, or other sensitive data beyond the plugin itself. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and zero authentication requirement make this straightforward to exploit once a victim is lured to a crafted URL.
Arbitrary file deletion via path traversal in the SureDash WordPress plugin (Brainstorm Force) affects all versions up to and including 1.8.0, allowing an authenticated low-privilege user to delete files outside the plugin's intended directory by supplying crafted pathnames. The Patchstack reference explicitly characterizes the flaw as arbitrary file deletion, meaning an attacker can remove critical files such as wp-config.php to disrupt the site or force a re-installation takeover. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the CVSS 9.9 rating reflects the low barrier to exploitation.
Blind SQL injection in Brainstorm Force SureDash WordPress plugin versions up to and including 1.8.0 allows authenticated low-privileged attackers to inject arbitrary SQL commands through unsanitized input. The scope-changed CVSS 8.5 score reflects that exploitation can impact resources beyond the vulnerable component, exposing sensitive WordPress database contents to remote attackers. No public exploit identified at time of analysis.
Unauthenticated PHP Object Injection in the OttoKit WordPress plugin (formerly SureTriggers) versions 1.1.27 and earlier allows remote attackers to deserialize attacker-controlled PHP objects against any site running the plugin. With a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and a CWE-502 deserialization root cause, successful exploitation can lead to full code execution, data theft, or site takeover when a suitable POP gadget chain is present in WordPress core or another installed plugin. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.
Privilege escalation in the WooCommerce Cart Abandonment Recovery WordPress plugin before version 2.1.0 allows an authenticated shop manager to elevate privileges beyond their intended role on affected WordPress sites. The flaw, tracked as CWE-266 (Incorrect Privilege Assignment), carries a CVSS 7.2 (High) score and has a vendor-released patch in 2.1.0, with no public exploit identified at time of analysis.
Broken access control in the SureForms Pro WordPress form-builder plugin (versions up to and including 2.8.0) lets remote unauthenticated attackers reach functionality that should be protected by capability checks, resulting in limited confidentiality, integrity, and availability impact. The flaw stems from missing authorization (CWE-862) on incorrectly configured access-control security levels rather than a memory-safety or injection bug. EPSS is very low (0.01%, 2nd percentile) and there is no public exploit identified at time of analysis, though SSVC rates the flaw as automatable with partial technical impact.
Blind SQL injection in Brainstorm Force OttoKit (WordPress plugin suretriggers) versions up to 1.1.20 allows privileged attackers with high-level administrative access to extract sensitive database information and potentially cause service disruptions. CVSS 7.6 severity driven by changed scope (container escape to underlying WordPress database). EPSS score of 0.02% (6th percentile) indicates very low observed exploitation probability. No public exploit identified at time of analysis, and no CISA KEV listing confirms active exploitation.
Arbitrary file deletion in the SureDash WordPress plugin through version 1.12.3 allows an authenticated low-privilege user, such as a Subscriber, to delete files on the hosting server via a path traversal flaw (CWE-22). The impact is limited to integrity and availability (CVSS 5.0; assessed vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L), with the main barrier being the need for a valid account, a barrier that open subscriber registration can effectively remove. No CISA KEV entry and no public exploit were identified at time of analysis; this is a moderate, this-month priority rather than an emergency.
Stored cross-site scripting (CWE-79) in the Ultimate Addons for Elementor - Lite plugin (slug header-footer-elementor) affects every release through 2.9.5. An authenticated WordPress user who holds enough privilege to save content into the affected plugin fields can persist a script payload that later executes in the browser of another user who loads the page or screen rendering it, giving a scope-changed (S:C) impact rated 6.5 under CVSS 3.1. The flaw requires an account (PR:L) and victim interaction (UI:R); it is not listed in CISA KEV and no public exploit was identified at time of analysis, so it should be handled as a routine, prioritized patch within the current monthly cycle rather than an emergency.
Missing authorization in the Brainstorm Force SureDash WordPress plugin through 1.12.3 lets an authenticated low-privileged user bypass intended access controls on SureDash functionality or data, with confidentiality-only impact. The CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) reflects the need for a valid account and the absence of integrity or availability effects, and the available signals place remediation in the this_month priority band rather than an emergency. No CISA KEV entry or public exploit code is associated with this CVE in the supplied data, and no public exploit was identified at time of analysis.
Stored cross-site scripting in the Brainstorm Force SureDash WordPress plugin affects versions through 1.12.3; an authenticated low-privilege user can store malicious input that executes when a separate victim loads the affected page. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (medium severity), Patchstack reported the flaw, and no public exploit was identified at time of analysis. The vuln.today priority is this_month.
Missing authorization in the Brainstorm Force SureForms WordPress plugin through 2.12.9 allows unauthenticated remote attackers to perform a privileged action that the plugin's incorrectly configured access-control check fails to restrict, with limited integrity impact and no confidentiality or availability effect. The flaw is rated CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) and affects releases from the earliest version through 2.12.9. No public exploit was identified at time of analysis, and the precise vulnerable endpoint or configuration trigger is not described in the available sources.
Brainstorm Force SureDash through 1.12.2 does not enforce authorization for low-privileged users, allowing an authenticated WordPress account to read data intended for higher-privileged roles; the issue is scored CVSS 6.5 with confidentiality-only impact. The flaw is CWE-862 missing authorization, and no public exploit was identified at time of analysis. Sites that allow untrusted user registration have the larger exposure because a low-privileged account is the prerequisite.
Missing authorization in the Brainstorm Force SureDash WordPress plugin through 1.12.2 allows unauthenticated, network-based attackers to reach functionality that should require access checks, with low confidentiality impact and no integrity or availability impact under the assessed CVSS vector. The vulnerable endpoint and protected resource are not described in the available sources, so default-configuration exploitability cannot be confirmed, and realistic impact depends on the site's SureDash access-level configuration. No public exploit identified at time of analysis and no CISA KEV entry is present; the priority is this_month, consistent with a moderate, not emergency-level, issue.
SureDash WordPress plugin through 1.12.2 contains a missing authorization flaw (CWE-862) that can expose low-sensitivity information to unauthenticated remote attackers. The Patchstack description ties exploitation to incorrectly configured access-control security levels, but the specific endpoint and whether a non-default access-level configuration is required are not specified in the supplied sources; impact is limited to confidentiality with no integrity or availability effect. No public exploit was identified at time of analysis, and the issue is assessed as moderate severity and low priority (decision label: this_month).
Stored cross-site scripting in the Brainstorm Force SureCart WordPress plugin (all versions through 4.9.5) allows an authenticated low-privileged user to persist a script payload that later executes in a higher-privileged administrator's browser when the affected page is viewed, matching CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (6.5). Because exploitation requires both a foothold account capable of submitting the stored data and victim interaction, the practical risk is bounded rather than a self-propagating compromise, and the scope change (S:C) means the payload executes in the administrator's session context rather than the attacker's. No public exploit code and no CISA KEV entry were identified at time of analysis, and the available data does not identify a fixed SureCart release, so sites on 4.9.5 or earlier should be treated as unpatched pending confirmation from the Patchstack advisory.
Stored cross-site scripting in the Brainstorm Force Presto Player WordPress plugin, affecting all versions through 4.5.3, allows an authenticated user with low-level content privileges to persist malicious JavaScript that executes in the browser of any other user who views the affected page. Successful exploitation requires a victim to interact with the crafted content (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, score 6.5), so it is a two-actor, stored attack rather than a direct unauthenticated compromise; the scope change (S:C) reflects that script executes in the context of the victim's session rather than the attacker's. No public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS data was not provided, so the near-term risk is moderate and driven primarily by the large installed base of the plugin.
Stored cross-site scripting in the SureCart WordPress plugin (Brainstorm Force / SureCart) through version 4.9.4 allows a low-privilege authenticated user to persist malicious JavaScript into plugin-rendered content, which then executes in the browser of any user who views the affected page. Rated CVSS 6.5 (medium), the flaw is remote and network-reachable (AV:N) but tempered by two prerequisites: an attacker must first hold a valid low-privilege account (PR:L), and a victim - typically a site administrator or another authenticated user - must load the poisoned page for the payload to fire (UI:R). No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, so this appears to be a coordinated disclosure via Patchstack rather than a defect under active exploitation; exposure is highest on sites that allow untrusted visitors to self-register customer or contributor accounts.
Stored cross-site scripting in the Brainstorm Force SureForms WordPress plugin (all versions through 2.12.7) allows an authenticated low-privileged user to inject script payloads through form fields that execute when a higher-privileged user, typically an administrator, later views the stored submission. Rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), the flaw requires an existing submission-capable account plus victim-driven user interaction, so it is not remotely exploitable without authentication. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Missing authorization checks in the Starter Templates (astra-sites) WordPress plugin, affecting versions through 4.7.7, allow a remote attacker holding a low-privilege account on the target site - such as a subscriber where open registration is enabled - to trigger plugin functionality that should be restricted to higher-privileged roles, resulting in low-level integrity and availability impact with no confidentiality loss (CVSS 5.4). The flaw is a CWE-862 incorrectly configured access-control level, requiring no user interaction and no special complexity, but it cannot be reached by a fully unauthenticated visitor (CVSS vector PR:L). At the time of analysis there is no public exploit identified and no indication of confirmed active exploitation, so risk is driven primarily by the population of sites running the plugin with open or loosely controlled user registration.
Stored cross-site scripting in the Brainstorm Force Starter Templates (astra-sites) WordPress plugin, affecting all versions through 4.7.7, allows an authenticated user with only low-level privileges to plant persistent JavaScript that executes in the browser of a higher-privileged user (such as an administrator or editor) who later views the affected page. Rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), exploitation consumes a valid low-privilege account plus victim interaction, so it is not remote-unauthenticated and the realistic attacker population is limited to sites that permit untrusted registration or loose role assignment. There is no CISA KEV listing and no public exploit code identified at time of analysis; risk is moderate and warrants routine rather than emergency patching.
Stored cross-site scripting in the Presto Player WordPress plugin (Brainstorm Force) through version 4.5.2 lets an authenticated attacker with at least low-level content-contribution privileges save a malicious payload into a Presto Player field, which then executes in the browser of any user who views the affected page. Because the assessed vector is PR:L/UI:R with a scope change (S:C), the attacker cannot be fully anonymous and the impact depends on a second, potentially privileged victim loading the stored content, which is why this is rated medium severity at CVSS 6.5. There is no public exploit identified at time of analysis and no confirmed active exploitation; the only public reference is the Patchstack advisory.
Content injection in Astra WordPress Theme 4.13.12 and earlier allows an authenticated WooCommerce Shop Manager to insert untrusted markup or script content into affected pages. The flaw is network-reachable and low-complexity but requires high privileges and an active WooCommerce installation, yielding only limited integrity impact with no confidentiality or availability loss; CVSS is 2.7. No public exploit identified at time of analysis, and it is not confirmed actively exploited (CISA KEV).
Contributor-level Insecure Direct Object Reference (IDOR) in the Starter Templates WordPress plugin (≤4.7.5) permits authenticated low-privilege users to manipulate object identifiers in plugin requests, modifying resources outside their authorized scope. Reported by Patchstack with a CVSS 4.3, the flaw is bounded to integrity-only impact - no data disclosure or availability disruption applies. No public exploit code and no active exploitation via CISA KEV have been identified at time of analysis.
Unauthenticated information disclosure in SureForms (WordPress form-builder plugin by Brainstorm Force) versions through 2.12.5 allows remote attackers to access restricted data by manipulating user-controlled object identifiers. The root cause is CWE-639 - Authorization Bypass Through User-Controlled Key - a classic IDOR pattern in which the plugin returns object-level data without verifying that the caller has rights to the requested record. Reported by Patchstack; no active exploitation or public proof-of-concept has been identified at time of analysis.
Stored Cross-Site Scripting in the Ultimate Addons for Elementor WordPress plugin (versions <= 1.45.2) allows authenticated contributors to inject persistent malicious scripts that execute in the browsers of higher-privileged users such as site administrators. The CVSS vector (PR:L/UI:R/S:C) confirms this is a contributor-level stored XSS with scope change - a low-privilege WordPress role can trigger execution in an admin's browsing context, enabling session hijacking or privilege escalation. No public exploit or KEV listing has been identified at time of analysis, but Patchstack has formally reported and documented this vulnerability.
Broken access control in Brainstorm Force's Presto Player WordPress plugin (through version 4.1.3) allows authenticated low-privilege users to bypass authorization checks and read restricted data. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms this is network-exploitable by any authenticated WordPress user with no interaction required, though impact is limited to low confidentiality exposure with no integrity or availability consequences. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Missing authorization checks in the Spectra (ultimate-addons-for-gutenberg) WordPress plugin by Brainstorm Force allow authenticated low-privileged users to access restricted functionality or data beyond their intended permission level. All versions through 2.19.22 are affected, and the CVSS vector (PR:L, C:L) confirms that exploitation requires an existing authenticated session and yields only limited confidentiality exposure. No public exploit code exists and SSVC classifies exploitation status as none, making this a low-urgency but actionable remediation target for WordPress sites with open user registration.
Missing authorization in Brainstorm Force CartFlows WordPress plugin versions up to 2.2.3 allows authenticated attackers to modify data through incorrectly configured access control, enabling unauthorized changes to plugin settings or resources. CVSS 4.3 (low severity) with EPSS 0.02% indicates limited real-world exploitation probability; the vulnerability requires prior authentication and does not enable code execution or confidentiality breaches.
A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the Brainstorm Force Astra Bulk Edit WordPress plugin through version 1.2.10, allowing authenticated attackers to inject malicious scripts that execute in the context of other users' browsers. An attacker with low-privilege account access (e.g., contributor or editor role) can craft malicious input that, when processed by the bulk edit functionality, results in arbitrary JavaScript execution affecting site administrators and other users. The vulnerability requires user interaction (UI:R) but can affect multiple users across the site due to its stored/DOM-based nature, making it a persistent attack vector for privilege escalation or data exfiltration.