Vulnerabilities in brainstormforce

56 results
Vexday analysis

O portfólio de vulnerabilidades da Brainstormforce reúne 50 CVEs catalogadas, com taxa de exploração ativa abaixo da média geral do catálogo KEV, o que indica menor pressão imediata de ataques confirmados. Ainda assim, a atenção deve recair sobre CVE-2025-3102, que concentra o maior score EPSS observado no conjunto (0,762), sinalizando probabilidade elevada de exploração em curto prazo mesmo sem confirmação KEV. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), categoria que, embora frequentemente subestimada, facilita ataques de sequestro de sessão e injeção de conteúdo malicioso em ambientes WordPress. A presença de prova de conceito pública associada à CVE mais crítica reforça a necessidade de priorizar a aplicação de correções sem aguardar evidências de exploração ativa.

CVE-2024-2141MEDIUMUltimate Addons for Beaver Builder – Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button WidgetEPSS 0.4%CVE-2024-2144MEDIUMUltimate Addons for Beaver Builder – Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Separator WidgetEPSS 0.4%CVE-2020-36702MEDIUMSpectra – WordPress Gutenberg Blocks <= 1.14.7 - Missing AuthorizationEPSS 0.4%CVE-2024-5757MEDIUMElementor Header & Footer Builder <= 1.6.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via Site Title WidgetEPSS 0.4%CVE-2024-4632MEDIUMWooCommerce Checkout & Funnel Builder by CartFlows – Create High Converting Stores For WooCommerce <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-2619MEDIUMElementor Header & Footer Builder <= 1.6.26 - Authenticated (Author+) HTML InjectionEPSS 0.4%CVE-2024-4634MEDIUMElementor Header & Footer Builder <= 1.6.28 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-5485MEDIUMSureTriggers – Connect All Your Plugins, Apps, Tools & Automate Everything! <= 1.0.46 - Authenticated (Contributor+) Stored Cross-Site Scripting via Trigger Link ShortcodeEPSS 0.4%CVE-2024-2347MEDIUMAstra <= 4.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Display NameEPSS 0.4%CVE-2026-0950MEDIUMSpectra Gutenberg Blocks <= 2.19.17 - Unauthenticated Information Disclosure in Sensitive DataEPSS 0.3%CVE-2024-2143MEDIUMUltimate Addons for Beaver Builder – Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading WidgetEPSS 0.3%CVE-2024-12713MEDIUMSureForms – Drag and Drop Form Builder for WordPress <= 1.2.2 - Missing Authorization to Unauthenticated Protected Post DisclosureEPSS 0.3%CVE-2024-2140MEDIUMUltimate Addons for Beaver Builder – Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Icons WidgetEPSS 0.3%CVE-2026-15288HIGHSureForms – Drag and Drop Form Builder for WordPress <= 2.2.1 - Unauthenticated Stripe Payment Amount ManipulationEPSS 0.3%CVE-2026-9065CRITICALSurecart - SQL InjectionEPSS 0.3%CVE-2025-14855HIGHSureForms <= 2.2.0 - Unauthenticated Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-2618MEDIUMElementor Header & Footer Builder <= 1.6.26 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-11230MEDIUMElementor Header & Footer Builder <= 1.6.46 - Authenticated (Contributor+) Stored Cross-Site Scripting via Page Title WidgetEPSS 0.3%CVE-2024-10484MEDIUMSpectra – WordPress Gutenberg Blocks <= 2.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team WidgetEPSS 0.3%CVE-2024-10325MEDIUMElementor Header & Footer Builder <= 1.6.45 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File UploadEPSS 0.3%