CVE-2026-66688 is a cross-site scripting (XSS) vulnerability in Brainstorm Force's Ultimate Addons for Elementor plugin, affecting versions up to and including 1.45.2. The flaw involves improper neutralization of input during web page generation, allowing an attacker with contributor-level privileges to execute malicious scripts. This vulnerability has a medium severity rating with a CVSS score of 6.5. No official patch or remediation guidance has been provided by the vendor as of the publication date.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Brainstorm Force SureDash suredash allows Path Traversal.This issue affects SureDash: from n/a through <= 1.8.0.
Brainstorm Force SureDash versions up to and including 1.8.0 contain a SQL Injection vulnerability that allows blind SQL injection attacks. This vulnerability arises from improper neutralization of special elements in SQL commands. The issue has a high severity rating with a CVSS score of 8.5. No official patch or remediation guidance is currently available from the vendor.
A high-severity privilege escalation vulnerability exists in Brainstorm Force WooCommerce Cart Abandonment Recovery versions prior to 2.1.0. This flaw allows shop managers to gain elevated privileges improperly due to incorrect privilege assignment. The vulnerability is tracked as CVE-2026-39470 and is categorized under CWE-266.
Missing Authorization vulnerability in Brainstorm Force Presto Player allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects Presto Player: from n/a through 4.1.3.
Missing Authorization vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through <= 2.19.22.
Missing Authorization vulnerability in Brainstorm Force SureForms Pro allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects SureForms Pro: from n/a through 2.8.0.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Brainstorm Force OttoKit suretriggers allows Blind SQL Injection.This issue affects OttoKit: from n/a through <= 1.1.20.
Missing Authorization vulnerability in Brainstorm Force CartFlows cartflows allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CartFlows: from n/a through <= 2.2.3.
CVE-2026-34889 is a medium severity vulnerability in Brainstorm Force Ultimate Addons for WPBakery Page Builder that allows DOM-based Cross-site Scripting (XSS) due to improper neutralization of input during web page generation. This vulnerability affects versions before 3.21.4. It requires low attack complexity but privileges and user interaction, and it impacts confidentiality, integrity, and availability to a limited extent. No official patch or vendor advisory is currently provided, and no known exploits are reported in the wild.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Astra Bulk Edit astra-bulk-edit allows DOM-Based XSS.This issue affects Astra Bulk Edit: from n/a through <= 1.2.10.
Deserialization of Untrusted Data vulnerability in Brainstorm Force CartFlows cartflows allows Object Injection.This issue affects CartFlows: from n/a through <= 2.1.19.
Missing Authorization vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through <= 2.19.17.
Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force Sigmize sigmize allows Cross Site Request Forgery.This issue affects Sigmize: from n/a through <= 0.0.9.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Astra Widgets astra-widgets allows Stored XSS.This issue affects Astra Widgets: from n/a through <= 1.2.16.
Missing Authorization vulnerability in Brainstorm Force Spectra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through 2.3.0.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureRank surerank.This issue affects SureRank: from n/a through <= 1.3.2.
The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to 3.21.1 (exclusive) due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Incorrect Privilege Assignment vulnerability in Brainstorm Force SureDash suredash allows Privilege Escalation.This issue affects SureDash: from n/a through <= 1.0.3.
