{"schema_version":1,"title":"Brainstorm Force vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 22 vulnerabilities in Brainstorm Force: 0 in the last 7 days and 15 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-62134, was published on 11 September 2026. 3 technologies have a page of their own.","url":"https://junglewise.ai/threats/vendors/brainstorm-force","json_url":"https://junglewise.ai/threats/vendors/brainstorm-force.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/brainstorm-force","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","counts":{"high":7,"all_time":22,"critical":2,"exploited":0,"last_7_days":0,"last_30_days":2,"last_90_days":15,"last_365_days":22},"latest":[{"cve":"CVE-2026-62134","cvss":4.3,"epss":0.0025,"slug":"cve-2026-62134-starter-templates-contributor-idor-vulnerability","title":"Starter Templates contributor IDOR vulnerability","severity":"medium","exploited":false,"published_at":"2026-09-11T19:17:44.75+00:00","url":"https://junglewise.ai/threats/cve-2026-62134-starter-templates-contributor-idor-vulnerability"},{"cve":"CVE-2026-85308","cvss":5.3,"epss":0.0034,"slug":"cve-2026-85308-brainstorm-force-sureforms-authorization-bypass-in-access-control","title":"Brainstorm Force SureForms authorization bypass in access control","severity":"medium","exploited":false,"published_at":"2026-09-03T17:17:31.097+00:00","url":"https://junglewise.ai/threats/cve-2026-85308-brainstorm-force-sureforms-authorization-bypass-in-access-control"},{"cve":"CVE-2026-80433","cvss":7.5,"epss":0.0039,"slug":"cve-2026-80433-surefeedback-client-site-sensitive-data-exposure","title":"SureFeedback Client Site sensitive data exposure","severity":"high","exploited":false,"published_at":"2026-08-27T10:16:38.78+00:00","url":"https://junglewise.ai/threats/cve-2026-80433-surefeedback-client-site-sensitive-data-exposure"},{"cve":"CVE-2026-32553","cvss":7.2,"epss":0.0027,"slug":"cve-2026-32553-ottokit-server-side-request-forgery","title":"OttoKit server-side request forgery","severity":"high","exploited":false,"published_at":"2026-08-18T15:16:53.623+00:00","url":"https://junglewise.ai/threats/cve-2026-32553-ottokit-server-side-request-forgery"},{"cve":"CVE-2026-66688","cvss":6.5,"epss":0.0022,"slug":"cve-2026-66688-ultimate-addons-for-elementor-contributor-cross-site-scripting","title":"Ultimate Addons for Elementor Contributor Cross Site Scripting","severity":"medium","exploited":false,"published_at":"2026-08-06T15:17:22.107+00:00","url":"https://junglewise.ai/threats/cve-2026-66688-ultimate-addons-for-elementor-contributor-cross-site-scripting"},{"cve":"CVE-2026-10827","cvss":3.5,"slug":"cve-2026-10827-spectra-wordpress-plugin-stored-css-injection-in-block-attributes","title":"Spectra WordPress plugin stored CSS injection in block attributes","severity":"info","exploited":false,"published_at":"2026-08-01T07:16:28.573+00:00","url":"https://junglewise.ai/threats/cve-2026-10827-spectra-wordpress-plugin-stored-css-injection-in-block-attributes"},{"cve":"CVE-2026-7623","cvss":6.4,"slug":"cve-2026-7623-brainstorm-force-sureforms-stored-xss-in-headingwrapper-parameter","title":"Brainstorm Force SureForms stored XSS in headingWrapper parameter","severity":"medium","exploited":false,"published_at":"2026-08-01T03:16:26.07+00:00","url":"https://junglewise.ai/threats/cve-2026-7623-brainstorm-force-sureforms-stored-xss-in-headingwrapper-parameter"},{"cve":"CVE-2026-14921","cvss":7.5,"slug":"cve-2026-14921-brainstorm-force-ultimate-addons-for-wpbakery-page-builder-stored","title":"Brainstorm Force Ultimate Addons for WPBakery Page Builder Stored XSS","severity":"info","exploited":false,"published_at":"2026-07-31T07:16:26.067+00:00","url":"https://junglewise.ai/threats/cve-2026-14921-brainstorm-force-ultimate-addons-for-wpbakery-page-builder-stored"},{"cve":"CVE-2026-15382","cvss":6.5,"slug":"cve-2026-15382-brainstorm-force-ultimate-addons-for-wpbakery-unauthenticated","title":"Brainstorm Force Ultimate Addons for WPBakery unauthenticated font deletion","severity":"info","exploited":false,"published_at":"2026-07-30T06:25:02.33+00:00","url":"https://junglewise.ai/threats/cve-2026-15382-brainstorm-force-ultimate-addons-for-wpbakery-unauthenticated"},{"cve":"CVE-2026-15821","cvss":6.4,"slug":"cve-2026-15821-brainstorm-force-suredash-stored-xss-in-shortcode-attributes","title":"Brainstorm Force SureDash Stored XSS in Shortcode Attributes","severity":"medium","exploited":false,"published_at":"2026-07-24T09:16:24.387+00:00","url":"https://junglewise.ai/threats/cve-2026-15821-brainstorm-force-suredash-stored-xss-in-shortcode-attributes"},{"cve":"CVE-2026-15787","cvss":6.4,"slug":"cve-2026-15787-brainstorm-force-ultimate-addons-for-elementor-stored-xss-in","title":"Brainstorm Force Ultimate Addons for Elementor Stored XSS in Navigation Menu Widget","severity":"medium","exploited":false,"published_at":"2026-07-22T09:16:27.847+00:00","url":"https://junglewise.ai/threats/cve-2026-15787-brainstorm-force-ultimate-addons-for-elementor-stored-xss-in"},{"cve":"CVE-2026-12900","cvss":6.4,"slug":"cve-2026-12900-brainstorm-force-spectra-stored-xss-in-uagb-image-block","title":"Brainstorm Force Spectra Stored XSS in uagb/image block","severity":"medium","exploited":false,"published_at":"2026-07-20T22:17:13.257+00:00","url":"https://junglewise.ai/threats/cve-2026-12900-brainstorm-force-spectra-stored-xss-in-uagb-image-block"},{"cve":"CVE-2026-12869","cvss":6.8,"slug":"cve-2026-12869-header-footer-builder-for-elementor-stored-xss-via-template","title":"Header Footer Builder for Elementor Stored XSS via Template Import","severity":"info","exploited":false,"published_at":"2026-07-16T07:16:47.3+00:00","url":"https://junglewise.ai/threats/cve-2026-12869-header-footer-builder-for-elementor-stored-xss-via-template"},{"cve":"CVE-2026-57401","cvss":9.9,"slug":"cve-2026-57401-brainstorm-force-suredash-path-traversal-arbitrary-file-deletion","title":"Brainstorm Force SureDash path traversal arbitrary file deletion","severity":"critical","exploited":false,"published_at":"2026-07-13T10:16:33.683+00:00","url":"https://junglewise.ai/threats/cve-2026-57401-brainstorm-force-suredash-path-traversal-arbitrary-file-deletion"},{"cve":"CVE-2026-15288","cvss":7.5,"slug":"cve-2026-15288-brainstorm-force-sureforms-improper-input-validation-in-payment","title":"Brainstorm Force SureForms improper input validation in payment processing","severity":"high","exploited":false,"published_at":"2026-07-10T05:16:31.923+00:00","url":"https://junglewise.ai/threats/cve-2026-15288-brainstorm-force-sureforms-improper-input-validation-in-payment"},{"cve":"CVE-2026-54813","cvss":8.5,"epss":0.0021,"slug":"cve-2026-54813-brainstorm-force-suredash-blind-sql-injection","title":"Brainstorm Force SureDash blind SQL injection","severity":"high","exploited":false,"published_at":"2026-06-17T14:17:59.01+00:00","url":"https://junglewise.ai/threats/cve-2026-54813-brainstorm-force-suredash-blind-sql-injection"},{"cve":"CVE-2026-49781","cvss":9.8,"slug":"cve-2026-49781-brainstorm-force-ottokit-php-object-injection","title":"Brainstorm Force OttoKit PHP object injection","severity":"critical","exploited":false,"published_at":"2026-06-15T21:17:22.64+00:00","url":"https://junglewise.ai/threats/cve-2026-49781-brainstorm-force-ottokit-php-object-injection"},{"cve":"CVE-2026-39470","cvss":7.2,"slug":"cve-2026-39470-brainstorm-force-woocommerce-cart-abandonment-recovery-privilege","title":"Brainstorm Force WooCommerce Cart Abandonment Recovery privilege escalation","severity":"high","exploited":false,"published_at":"2026-06-15T21:16:43.74+00:00","url":"https://junglewise.ai/threats/cve-2026-39470-brainstorm-force-woocommerce-cart-abandonment-recovery-privilege"},{"cve":"CVE-2026-7465","cvss":8.8,"slug":"cve-2026-7465-brainstorm-force-spectra-gutenberg-blocks-remote-code-execution","title":"Brainstorm Force Spectra Gutenberg Blocks Remote Code Execution","severity":"high","exploited":false,"published_at":"2026-05-30T10:16:23.86+00:00","url":"https://junglewise.ai/threats/cve-2026-7465-brainstorm-force-spectra-gutenberg-blocks-remote-code-execution"},{"cve":"CVE-2026-45442","cvss":4.3,"slug":"cve-2026-45442-brainstorm-force-presto-player-missing-authorization-in-access","title":"Brainstorm Force Presto Player missing authorization in access control","severity":"medium","exploited":false,"published_at":"2026-05-19T12:16:19.13+00:00","url":"https://junglewise.ai/threats/cve-2026-45442-brainstorm-force-presto-player-missing-authorization-in-access"},{"cve":"CVE-2026-39479","cvss":7.6,"epss":0.0028,"slug":"cve-2026-39479-brainstorm-force-ottokit-blind-sql-injection-in-suretriggers","title":"Brainstorm Force OttoKit blind SQL injection in suretriggers","severity":"high","exploited":false,"published_at":"2026-04-08T09:16:22.67+00:00","url":"https://junglewise.ai/threats/cve-2026-39479-brainstorm-force-ottokit-blind-sql-injection-in-suretriggers"},{"cve":"CVE-2026-39477","cvss":4.3,"epss":0.0022,"slug":"cve-2026-39477-brainstorm-force-cartflows-missing-authorization-in-wordpress","title":"Brainstorm Force CartFlows missing authorization in WordPress plugin","severity":"medium","exploited":false,"published_at":"2026-04-08T09:16:22.527+00:00","url":"https://junglewise.ai/threats/cve-2026-39477-brainstorm-force-cartflows-missing-authorization-in-wordpress"}],"vendor":{"hub":true,"name":"Brainstorm Force","slug":"brainstorm-force","homepage":"https://brainstormforce.com/","description":"Brainstorm Force is a software development company that creates themes and plugins for WordPress.","url":"https://junglewise.ai/threats/vendors/brainstorm-force"},"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-07-13","critical":1,"exploited":0,"vulnerabilities":2},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":3},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":4},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2026-57401","cvss":9.9,"slug":"cve-2026-57401-brainstorm-force-suredash-path-traversal-arbitrary-file-deletion","title":"Brainstorm Force SureDash path traversal arbitrary file deletion","severity":"critical","exploited":false,"published_at":"2026-07-13T10:16:33.683+00:00","url":"https://junglewise.ai/threats/cve-2026-57401-brainstorm-force-suredash-path-traversal-arbitrary-file-deletion"},{"cve":"CVE-2026-49781","cvss":9.8,"slug":"cve-2026-49781-brainstorm-force-ottokit-php-object-injection","title":"Brainstorm Force OttoKit PHP object injection","severity":"critical","exploited":false,"published_at":"2026-06-15T21:17:22.64+00:00","url":"https://junglewise.ai/threats/cve-2026-49781-brainstorm-force-ottokit-php-object-injection"},{"cve":"CVE-2026-7465","cvss":8.8,"slug":"cve-2026-7465-brainstorm-force-spectra-gutenberg-blocks-remote-code-execution","title":"Brainstorm Force Spectra Gutenberg Blocks Remote Code Execution","severity":"high","exploited":false,"published_at":"2026-05-30T10:16:23.86+00:00","url":"https://junglewise.ai/threats/cve-2026-7465-brainstorm-force-spectra-gutenberg-blocks-remote-code-execution"},{"cve":"CVE-2026-54813","cvss":8.5,"epss":0.0021,"slug":"cve-2026-54813-brainstorm-force-suredash-blind-sql-injection","title":"Brainstorm Force SureDash blind SQL injection","severity":"high","exploited":false,"published_at":"2026-06-17T14:17:59.01+00:00","url":"https://junglewise.ai/threats/cve-2026-54813-brainstorm-force-suredash-blind-sql-injection"},{"cve":"CVE-2026-39479","cvss":7.6,"epss":0.0028,"slug":"cve-2026-39479-brainstorm-force-ottokit-blind-sql-injection-in-suretriggers","title":"Brainstorm Force OttoKit blind SQL injection in suretriggers","severity":"high","exploited":false,"published_at":"2026-04-08T09:16:22.67+00:00","url":"https://junglewise.ai/threats/cve-2026-39479-brainstorm-force-ottokit-blind-sql-injection-in-suretriggers"},{"cve":"CVE-2026-80433","cvss":7.5,"epss":0.0039,"slug":"cve-2026-80433-surefeedback-client-site-sensitive-data-exposure","title":"SureFeedback Client Site sensitive data exposure","severity":"high","exploited":false,"published_at":"2026-08-27T10:16:38.78+00:00","url":"https://junglewise.ai/threats/cve-2026-80433-surefeedback-client-site-sensitive-data-exposure"},{"cve":"CVE-2026-15288","cvss":7.5,"slug":"cve-2026-15288-brainstorm-force-sureforms-improper-input-validation-in-payment","title":"Brainstorm Force SureForms improper input validation in payment processing","severity":"high","exploited":false,"published_at":"2026-07-10T05:16:31.923+00:00","url":"https://junglewise.ai/threats/cve-2026-15288-brainstorm-force-sureforms-improper-input-validation-in-payment"},{"cve":"CVE-2026-32553","cvss":7.2,"epss":0.0027,"slug":"cve-2026-32553-ottokit-server-side-request-forgery","title":"OttoKit server-side request forgery","severity":"high","exploited":false,"published_at":"2026-08-18T15:16:53.623+00:00","url":"https://junglewise.ai/threats/cve-2026-32553-ottokit-server-side-request-forgery"},{"cve":"CVE-2026-39470","cvss":7.2,"slug":"cve-2026-39470-brainstorm-force-woocommerce-cart-abandonment-recovery-privilege","title":"Brainstorm Force WooCommerce Cart Abandonment Recovery privilege escalation","severity":"high","exploited":false,"published_at":"2026-06-15T21:16:43.74+00:00","url":"https://junglewise.ai/threats/cve-2026-39470-brainstorm-force-woocommerce-cart-abandonment-recovery-privilege"},{"cve":"CVE-2026-66688","cvss":6.5,"epss":0.0022,"slug":"cve-2026-66688-ultimate-addons-for-elementor-contributor-cross-site-scripting","title":"Ultimate Addons for Elementor Contributor Cross Site Scripting","severity":"medium","exploited":false,"published_at":"2026-08-06T15:17:22.107+00:00","url":"https://junglewise.ai/threats/cve-2026-66688-ultimate-addons-for-elementor-contributor-cross-site-scripting"}],"generated_at":"2026-09-26T10:22:00.132594+00:00","technologies":[{"name":"Brainstorm Force SureForms","slug":"sureforms","vulnerabilities":4,"url":"https://junglewise.ai/threats/technologies/sureforms"},{"name":"Brainstorm Force Spectra","slug":"spectra","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/spectra"},{"name":"Brainstorm Force SureDash","slug":"suredash","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/suredash"}]}