Vulnerabilidades em brainstormforce

56 resultados
Análise Vexday

O portfólio de vulnerabilidades da Brainstormforce reúne 50 CVEs catalogadas, com taxa de exploração ativa abaixo da média geral do catálogo KEV, o que indica menor pressão imediata de ataques confirmados. Ainda assim, a atenção deve recair sobre CVE-2025-3102, que concentra o maior score EPSS observado no conjunto (0,762), sinalizando probabilidade elevada de exploração em curto prazo mesmo sem confirmação KEV. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), categoria que, embora frequentemente subestimada, facilita ataques de sequestro de sessão e injeção de conteúdo malicioso em ambientes WordPress. A presença de prova de conceito pública associada à CVE mais crítica reforça a necessidade de priorizar a aplicação de correções sem aguardar evidências de exploração ativa.

CVE-2025-3102HIGHSureTriggers <= 1.0.78 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Administrative User CreationEPSS 75.7%CVE-2025-13065HIGHStarter Templates <= 4.4.41 - Authenticated (Author+) Arbitrary File Upload via WXR Upload BypassEPSS 13.1%CVE-2026-7465HIGHSpectra Gutenberg Blocks <= 2.19.25 - Authenticated (Contributor+) Remote Code Execution via Arbitrary PHP Function Call via Block AttributesEPSS 1.2%CVE-2025-6691HIGHSureForms – Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Submission DeletionEPSS 1.0%CVE-2025-13516HIGHSureMail – SMTP and Email Logs Plugin with Amazon SES, Postmark, and Other Providers <= 1.9.0 - Unauthenticated Arbitrary File UploadEPSS 0.9%CVE-2025-12536MEDIUMSureForms <= 1.13.1 - Missing Authorization to Unauthenticated Sensitive Information ExposureEPSS 0.8%CVE-2019-25151MEDIUMFunnel Builder <= 1.3.0 - Arbitrary Plugin ActivationEPSS 0.7%CVE-2026-4987HIGHSureForms <= 2.5.2 - Unauthenticated Payment Amount Validation Bypass via 'form_id'EPSS 0.7%CVE-2024-3107MEDIUMSpectra – WordPress Gutenberg Blocks <= 2.12.6 - Authenticated (Contributor+) Path TraversalEPSS 0.6%CVE-2021-42360HIGHStarter Templates — Elementor, Gutenberg & Beaver Builder Templates <= 2.7.0 Authenticated Block Import to Stored XSSEPSS 0.6%CVE-2024-1467MEDIUMStarter Templates — Elementor, WordPress & Beaver Builder Templates <= 4.1.6 - Authenticated (Contributor+) Server-Side Request ForgeryEPSS 0.6%CVE-2023-6486MEDIUMSpectra – WordPress Gutenberg Blocks <= 2.10.3 - Authenticated(Contributor+) Cross-Site Scripting via Custom CSSEPSS 0.6%CVE-2024-1237MEDIUMElementor Header & Footer Builder <= 1.6.24 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2024-10050MEDIUMElementor Header & Footer Builder <= 1.6.43 - Authenticated (Contributor+) Information Disclosure via ShortcodeEPSS 0.5%CVE-2025-6742HIGHSureForms – Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated PHP Object Injection (PHAR) Triggered via Admin Submission DeletionEPSS 0.5%CVE-2020-36747MEDIUMLightweight Sidebar Manager <= 1.1.4 - Cross-Site Request Forgery BypassEPSS 0.5%CVE-2020-36737MEDIUMImport / Export Customizer Settings <= 1.0.3 - Cross-Site Request Forgery BypassEPSS 0.5%CVE-2020-36736MEDIUMWooCommerce Checkout & Funnel Builder by CartFlows – Create High Converting Stores For WooCommerce <= 1.5.15 - Cross-Site Request Forgery BypassEPSS 0.5%CVE-2024-4630MEDIUMStarter Templates — Elementor, WordPress & Beaver Builder Templates <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.4%CVE-2024-2141MEDIUMUltimate Addons for Beaver Builder – Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button WidgetEPSS 0.4%