CVE-2026-39477

CVE-2026-39477 refers to a missing authorization vulnerability in the WordPress plugin CartFlows (Brainstorm Force), affecting CartFlows versions up to 2.2.3. The root cause is an incorrectly configured access-control mechanism that allows exploitation of access levels. CVSS 3.1 base metrics indi...

CVE-2026-25316 WordPress CartFlows plugin <= 2.1.19 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Brainstorm Force CartFlows cartflows allows Object Injection.This issue affects CartFlows: from n/a through = 2.1.19...

WordPress Funnel Builder by CartFlows plugin <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by wesley wcraft in WordPress Plugin CartFlows versions = 2.0.7...

WordPress CartFlows Pro Plugin <= 1.11.12 is vulnerable to Cross Site Request Forgery (CSRF)

Software CartFlows Pro Type Plugin Vulnerable versions = 1.11.12 Fixed in 1.11.13 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-36685 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 55367cef894b Credits Rafie Muhammad...

WordPress CartFlows Pro Plugin <= 1.11.11 is vulnerable to Cross Site Scripting (XSS)

Software CartFlows Pro Type Plugin Vulnerable versions = 1.11.11 Fixed in 1.11.12 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-36686 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID fde18e13d181 Credits Rafie Muhammad...