Vulnerabilites related to bestwebsoft - contact_form
CVE-2017-20055 (GCVE-0-2017-20055)
Vulnerability from cvelistv5
Published
2022-06-16 12:20
Modified
2025-04-15 14:24
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-80 - Basic Cross Site Scripting
Summary
A vulnerability classified as problematic has been found in BestWebSoft Contact Form Plugin 4.0.0. This affects an unknown part. The manipulation leads to basic cross site scripting (Stored). It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.0.2 is able to address this issue. It is recommended to upgrade the affected component.
References
| ► | URL | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| BestWebSoft | Contact Form Plugin |
Version: 4.0.0 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T21:45:25.194Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2017/Feb/100"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://sumofpwn.nl/advisory/2016/stored_cross_site_scripting_vulnerability_in_contact_form_wordpress_plugin.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://vuldb.com/?id.97389"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2017-20055",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-14T17:11:02.807428Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-15T14:24:31.117Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Contact Form Plugin",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "4.0.0"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Julien Rentrop"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability classified as problematic has been found in BestWebSoft Contact Form Plugin 4.0.0. This affects an unknown part. The manipulation leads to basic cross site scripting (Stored). It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.0.2 is able to address this issue. It is recommended to upgrade the affected component."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-80",
"description": "CWE-80 Basic Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-16T12:20:22.000Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://seclists.org/fulldisclosure/2017/Feb/100"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://sumofpwn.nl/advisory/2016/stored_cross_site_scripting_vulnerability_in_contact_form_wordpress_plugin.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://vuldb.com/?id.97389"
}
],
"title": "BestWebSoft Contact Form Plugin Stored cross site scriting",
"x_generator": "vuldb.com",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cna@vuldb.com",
"ID": "CVE-2017-20055",
"REQUESTER": "cna@vuldb.com",
"STATE": "PUBLIC",
"TITLE": "BestWebSoft Contact Form Plugin Stored cross site scriting"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Contact Form Plugin",
"version": {
"version_data": [
{
"version_value": "4.0.0"
}
]
}
}
]
},
"vendor_name": "BestWebSoft"
}
]
}
},
"credit": "Julien Rentrop",
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability classified as problematic has been found in BestWebSoft Contact Form Plugin 4.0.0. This affects an unknown part. The manipulation leads to basic cross site scripting (Stored). It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.0.2 is able to address this issue. It is recommended to upgrade the affected component."
}
]
},
"generator": "vuldb.com",
"impact": {
"cvss": {
"baseScore": "3.5",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-80 Basic Cross Site Scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://seclists.org/fulldisclosure/2017/Feb/100",
"refsource": "MISC",
"url": "http://seclists.org/fulldisclosure/2017/Feb/100"
},
{
"name": "https://sumofpwn.nl/advisory/2016/stored_cross_site_scripting_vulnerability_in_contact_form_wordpress_plugin.html",
"refsource": "MISC",
"url": "https://sumofpwn.nl/advisory/2016/stored_cross_site_scripting_vulnerability_in_contact_form_wordpress_plugin.html"
},
{
"name": "https://vuldb.com/?id.97389",
"refsource": "MISC",
"url": "https://vuldb.com/?id.97389"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2017-20055",
"datePublished": "2022-06-16T12:20:22.000Z",
"dateReserved": "2022-06-13T00:00:00.000Z",
"dateUpdated": "2025-04-15T14:24:31.117Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-125095 (GCVE-0-2014-125095)
Vulnerability from cvelistv5
Published
2023-04-09 05:31
Modified
2024-08-06 14:10
Severity ?
3.5 (Low) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
3.5 (Low) - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
3.5 (Low) - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
VLAI Severity ?
EPSS score ?
CWE
- CWE-79 - Cross Site Scripting
Summary
A vulnerability was found in BestWebSoft Contact Form Plugin 1.3.4 on WordPress and classified as problematic. Affected by this issue is the function bws_add_menu_render of the file bws_menu/bws_menu.php. The manipulation of the argument bwsmn_form_email leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.3.7 is able to address this issue. The name of the patch is 4d531f74b4a801c805dc80360d4ea1312e9a278f. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-225320.
References
| ► | URL | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| BestWebSoft | Contact Form Plugin |
Version: 1.3.4 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T14:10:56.681Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vdb-entry",
"technical-description",
"x_transferred"
],
"url": "https://vuldb.com/?id.225320"
},
{
"tags": [
"signature",
"permissions-required",
"x_transferred"
],
"url": "https://vuldb.com/?ctiid.225320"
},
{
"tags": [
"patch",
"x_transferred"
],
"url": "https://github.com/wp-plugins/contact-form-plugin/commit/4d531f74b4a801c805dc80360d4ea1312e9a278f"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Contact Form Plugin",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "1.3.4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "tool",
"value": "VulDB GitHub Commit Analyzer"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in BestWebSoft Contact Form Plugin 1.3.4 on WordPress and classified as problematic. Affected by this issue is the function bws_add_menu_render of the file bws_menu/bws_menu.php. The manipulation of the argument bwsmn_form_email leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.3.7 is able to address this issue. The name of the patch is 4d531f74b4a801c805dc80360d4ea1312e9a278f. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-225320."
},
{
"lang": "de",
"value": "Eine Schwachstelle wurde in BestWebSoft Contact Form Plugin 1.3.4 f\u00fcr WordPress gefunden. Sie wurde als problematisch eingestuft. Davon betroffen ist die Funktion bws_add_menu_render der Datei bws_menu/bws_menu.php. Durch das Manipulieren des Arguments bwsmn_form_email mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk erfolgen. Ein Aktualisieren auf die Version 1.3.7 vermag dieses Problem zu l\u00f6sen. Der Patch wird als 4d531f74b4a801c805dc80360d4ea1312e9a278f bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-20T07:12:42.020Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.225320"
},
{
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.225320"
},
{
"tags": [
"patch"
],
"url": "https://github.com/wp-plugins/contact-form-plugin/commit/4d531f74b4a801c805dc80360d4ea1312e9a278f"
}
],
"timeline": [
{
"lang": "en",
"time": "2023-04-07T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2023-04-07T00:00:00.000Z",
"value": "CVE reserved"
},
{
"lang": "en",
"time": "2023-04-07T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2023-04-26T07:49:29.000Z",
"value": "VulDB entry last update"
}
],
"title": "BestWebSoft Contact Form Plugin bws_menu.php bws_add_menu_render cross site scripting"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2014-125095",
"datePublished": "2023-04-09T05:31:04.461Z",
"dateReserved": "2023-04-07T16:43:16.681Z",
"dateUpdated": "2024-08-06T14:10:56.681Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-7475 (GCVE-0-2013-7475)
Vulnerability from cvelistv5
Published
2019-08-13 16:47
Modified
2024-08-06 18:09
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
The contact-form-plugin plugin before 3.52 for WordPress has XSS.
References
| ► | URL | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T18:09:16.901Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The contact-form-plugin plugin before 3.52 for WordPress has XSS."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-08-13T16:47:59",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-7475",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The contact-form-plugin plugin before 3.52 for WordPress has XSS."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wordpress.org/plugins/contact-form-plugin/#developers",
"refsource": "MISC",
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-7475",
"datePublished": "2019-08-13T16:47:59",
"dateReserved": "2019-08-12T00:00:00",
"dateUpdated": "2024-08-06T18:09:16.901Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2016-10869 (GCVE-0-2016-10869)
Vulnerability from cvelistv5
Published
2019-08-13 16:48
Modified
2024-08-06 03:38
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
The contact-form-plugin plugin before 4.0.2 for WordPress has XSS.
References
| ► | URL | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T03:38:56.737Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The contact-form-plugin plugin before 4.0.2 for WordPress has XSS."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-08-13T16:48:52",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-10869",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The contact-form-plugin plugin before 4.0.2 for WordPress has XSS."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wordpress.org/plugins/contact-form-plugin/#developers",
"refsource": "MISC",
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-10869",
"datePublished": "2019-08-13T16:48:52",
"dateReserved": "2019-08-12T00:00:00",
"dateUpdated": "2024-08-06T03:38:56.737Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-18491 (GCVE-0-2017-18491)
Vulnerability from cvelistv5
Published
2019-08-13 16:49
Modified
2024-08-05 21:20
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues.
References
| ► | URL | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T21:20:51.316Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-08-13T16:49:40",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-18491",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wordpress.org/plugins/contact-form-plugin/#developers",
"refsource": "MISC",
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-18491",
"datePublished": "2019-08-13T16:49:40",
"dateReserved": "2019-08-12T00:00:00",
"dateUpdated": "2024-08-05T21:20:51.316Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-2200 (GCVE-0-2024-2200)
Vulnerability from cvelistv5
Published
2024-04-09 18:58
Modified
2025-02-26 18:35
Severity ?
VLAI Severity ?
EPSS score ?
Summary
The Contact Form by BestWebSoft plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘cntctfrm_contact_subject’ parameter in all versions up to, and including, 4.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| bestwebsoft | Contact Form by BestWebSoft – Advanced Contact Us Form Builder for WordPress |
Version: * ≤ 4.2.8 |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-2200",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-11T15:54:28.122300Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-26T18:35:38.860Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T19:03:39.383Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/28524702-3428-4fca-afe8-71b3f2dd983d?source=cve"
},
{
"tags": [
"x_transferred"
],
"url": "https://plugins.trac.wordpress.org/changeset/3047840/contact-form-plugin"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Contact Form by BestWebSoft \u2013 Advanced Contact Us Form Builder for WordPress",
"vendor": "bestwebsoft",
"versions": [
{
"lessThanOrEqual": "4.2.8",
"status": "affected",
"version": "*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Krzysztof Zaj\u0105c"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Contact Form by BestWebSoft plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u2018cntctfrm_contact_subject\u2019 parameter in all versions up to, and including, 4.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-09T18:58:39.126Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/28524702-3428-4fca-afe8-71b3f2dd983d?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3047840/contact-form-plugin"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-03-05T00:00:00.000+00:00",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2024-03-13T00:00:00.000+00:00",
"value": "Disclosed"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2024-2200",
"datePublished": "2024-04-09T18:58:39.126Z",
"dateReserved": "2024-03-05T19:09:41.491Z",
"dateUpdated": "2025-02-26T18:35:38.860Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-10010 (GCVE-0-2012-10010)
Vulnerability from cvelistv5
Published
2023-04-09 05:31
Modified
2024-08-06 21:36
Severity ?
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
4.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
4.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
VLAI Severity ?
EPSS score ?
CWE
- CWE-352 - Cross-Site Request Forgery
Summary
A vulnerability was found in BestWebSoft Contact Form 3.21. It has been classified as problematic. This affects the function cntctfrm_settings_page of the file contact_form.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 3.22 is able to address this issue. The identifier of the patch is 8398d96ff0fe45ec9267d7259961c2ef89ed8005. It is recommended to upgrade the affected component. The identifier VDB-225321 was assigned to this vulnerability.
References
| ► | URL | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| BestWebSoft | Contact Form |
Version: 3.21 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T21:36:02.040Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vdb-entry",
"technical-description",
"x_transferred"
],
"url": "https://vuldb.com/?id.225321"
},
{
"tags": [
"signature",
"permissions-required",
"x_transferred"
],
"url": "https://vuldb.com/?ctiid.225321"
},
{
"tags": [
"patch",
"x_transferred"
],
"url": "https://github.com/wp-plugins/contact-form-plugin/commit/8398d96ff0fe45ec9267d7259961c2ef89ed8005"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Contact Form",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "3.21"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "tool",
"value": "VulDB GitHub Commit Analyzer"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in BestWebSoft Contact Form 3.21. It has been classified as problematic. This affects the function cntctfrm_settings_page of the file contact_form.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 3.22 is able to address this issue. The identifier of the patch is 8398d96ff0fe45ec9267d7259961c2ef89ed8005. It is recommended to upgrade the affected component. The identifier VDB-225321 was assigned to this vulnerability."
},
{
"lang": "de",
"value": "Es wurde eine Schwachstelle in BestWebSoft Contact Form 3.21 ausgemacht. Sie wurde als problematisch eingestuft. Hiervon betroffen ist die Funktion cntctfrm_settings_page der Datei contact_form.php. Durch Manipulieren mit unbekannten Daten kann eine cross-site request forgery-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Ein Aktualisieren auf die Version 3.22 vermag dieses Problem zu l\u00f6sen. Der Patch wird als 8398d96ff0fe45ec9267d7259961c2ef89ed8005 bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-12T08:42:46.005Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.225321"
},
{
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.225321"
},
{
"tags": [
"patch"
],
"url": "https://github.com/wp-plugins/contact-form-plugin/commit/8398d96ff0fe45ec9267d7259961c2ef89ed8005"
}
],
"timeline": [
{
"lang": "en",
"time": "2023-04-07T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2023-04-07T00:00:00.000Z",
"value": "CVE reserved"
},
{
"lang": "en",
"time": "2023-04-07T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2023-04-26T08:01:08.000Z",
"value": "VulDB last update"
}
],
"title": "BestWebSoft Contact Form contact_form.php cntctfrm_settings_page cross-site request forgery"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2012-10010",
"datePublished": "2023-04-09T05:31:03.479Z",
"dateReserved": "2023-04-07T16:44:56.778Z",
"dateUpdated": "2024-08-06T21:36:02.040Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-9295 (GCVE-0-2015-9295)
Vulnerability from cvelistv5
Published
2019-08-13 16:48
Modified
2024-08-06 08:43
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
The contact-form-plugin plugin before 3.96 for WordPress has XSS.
References
| ► | URL | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T08:43:42.565Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The contact-form-plugin plugin before 3.96 for WordPress has XSS."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-08-13T16:48:27",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-9295",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The contact-form-plugin plugin before 3.96 for WordPress has XSS."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wordpress.org/plugins/contact-form-plugin/#developers",
"refsource": "MISC",
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-9295",
"datePublished": "2019-08-13T16:48:27",
"dateReserved": "2019-08-12T00:00:00",
"dateUpdated": "2024-08-06T08:43:42.565Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-10022 (GCVE-0-2013-10022)
Vulnerability from cvelistv5
Published
2023-04-05 12:31
Modified
2024-08-06 18:09
Severity ?
3.5 (Low) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
3.5 (Low) - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
3.5 (Low) - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
VLAI Severity ?
EPSS score ?
CWE
- CWE-79 - Cross Site Scripting
Summary
A vulnerability, which was classified as problematic, has been found in BestWebSoft Contact Form Plugin 3.51 on WordPress. Affected by this issue is the function cntctfrm_display_form/cntctfrm_check_form of the file contact_form.php. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 3.52 is able to address this issue. The patch is identified as 642ef1dc1751ab6642ce981fe126325bb574f898. It is recommended to upgrade the affected component. VDB-225002 is the identifier assigned to this vulnerability.
References
| ► | URL | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| BestWebSoft | Contact Form Plugin |
Version: 3.51 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T18:09:17.085Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vdb-entry",
"technical-description",
"x_transferred"
],
"url": "https://vuldb.com/?id.225002"
},
{
"tags": [
"signature",
"permissions-required",
"x_transferred"
],
"url": "https://vuldb.com/?ctiid.225002"
},
{
"tags": [
"patch",
"x_transferred"
],
"url": "https://github.com/wp-plugins/contact-form-plugin/commit/642ef1dc1751ab6642ce981fe126325bb574f898"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Contact Form Plugin",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "3.51"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "tool",
"value": "VulDB GitHub Commit Analyzer"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability, which was classified as problematic, has been found in BestWebSoft Contact Form Plugin 3.51 on WordPress. Affected by this issue is the function cntctfrm_display_form/cntctfrm_check_form of the file contact_form.php. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 3.52 is able to address this issue. The patch is identified as 642ef1dc1751ab6642ce981fe126325bb574f898. It is recommended to upgrade the affected component. VDB-225002 is the identifier assigned to this vulnerability."
},
{
"lang": "de",
"value": "Eine problematische Schwachstelle wurde in BestWebSoft Contact Form Plugin 3.51 f\u00fcr WordPress entdeckt. Dies betrifft die Funktion cntctfrm_display_form/cntctfrm_check_form der Datei contact_form.php. Durch Manipulieren mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Ein Aktualisieren auf die Version 3.52 vermag dieses Problem zu l\u00f6sen. Der Patch wird als 642ef1dc1751ab6642ce981fe126325bb574f898 bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-20T05:38:48.844Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.225002"
},
{
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.225002"
},
{
"tags": [
"patch"
],
"url": "https://github.com/wp-plugins/contact-form-plugin/commit/642ef1dc1751ab6642ce981fe126325bb574f898"
}
],
"timeline": [
{
"lang": "en",
"time": "2023-03-22T00:00:00.000Z",
"value": "CVE reserved"
},
{
"lang": "en",
"time": "2023-04-05T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2023-04-05T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2023-04-22T17:11:34.000Z",
"value": "VulDB entry last update"
}
],
"title": "BestWebSoft Contact Form Plugin contact_form.php cntctfrm_check_form cross site scripting"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2013-10022",
"datePublished": "2023-04-05T12:31:03.375Z",
"dateReserved": "2023-03-22T11:08:35.385Z",
"dateUpdated": "2024-08-06T18:09:17.085Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-7481 (GCVE-0-2013-7481)
Vulnerability from cvelistv5
Published
2019-08-22 12:46
Modified
2024-08-06 18:09
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
The contact-form-plugin plugin before 3.3.5 for WordPress has XSS.
References
| ► | URL | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T18:09:17.142Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The contact-form-plugin plugin before 3.3.5 for WordPress has XSS."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-08-22T12:46:07",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-7481",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The contact-form-plugin plugin before 3.3.5 for WordPress has XSS."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wordpress.org/plugins/contact-form-plugin/#developers",
"refsource": "MISC",
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-7481",
"datePublished": "2019-08-22T12:46:07",
"dateReserved": "2019-08-21T00:00:00",
"dateUpdated": "2024-08-06T18:09:17.142Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-2171 (GCVE-0-2017-2171)
Vulnerability from cvelistv5
Published
2017-05-22 16:00
Modified
2024-08-05 13:48
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- Cross-site scripting
Summary
Cross-site scripting vulnerability in Captcha prior to version 4.3.0, Car Rental prior to version 1.0.5, Contact Form Multi prior to version 1.2.1, Contact Form prior to version 4.0.6, Contact Form to DB prior to version 1.5.7, Custom Admin Page prior to version 0.1.2, Custom Fields Search prior to version 1.3.2, Custom Search prior to version 1.36, Donate prior to version 2.1.1, Email Queue prior to version 1.1.2, Error Log Viewer prior to version 1.0.6, Facebook Button prior to version 2.54, Featured Posts prior to version 1.0.1, Gallery Categories prior to version 1.0.9, Gallery prior to version 4.5.0, Google +1 prior to version 1.3.4, Google AdSense prior to version 1.44, Google Analytics prior to version 1.7.1, Google Captcha (reCAPTCHA) prior to version 1.28, Google Maps prior to version 1.3.6, Google Shortlink prior to version 1.5.3, Google Sitemap prior to version 3.0.8, Htaccess prior to version 1.7.6, Job Board prior to version 1.1.3, Latest Posts prior to version 0.3, Limit Attempts prior to version 1.1.8, LinkedIn prior to version 1.0.5, Multilanguage prior to version 1.2.2, PDF & Print prior to version 1.9.4, Pagination prior to version 1.0.7, Pinterest prior to version 1.0.5, Popular Posts prior to version 1.0.5, Portfolio prior to version 2.4, Post to CSV prior to version 1.3.1, Profile Extra prior to version 1.0.7. PromoBar prior to version 1.1.1, Quotes and Tips prior to version 1.32, Re-attacher prior to version 1.0.9, Realty prior to version 1.1.0, Relevant - Related Posts prior to version 1.2.0, Sender prior to version 1.2.1, SMTP prior to version 1.1.0, Social Buttons Pack prior to version 1.1.1, Subscriber prior to version 1.3.5, Testimonials prior to version 0.1.9, Timesheet prior to version 0.1.5, Twitter Button prior to version 2.55, User Role prior to version 1.5.6, Updater prior to version 1.35, Visitors Online prior to version 1.0.0, and Zendesk Help Center prior to version 1.0.5 allows remote attackers to inject arbitrary web script or HTML via the function to display the BestWebSoft menu.
References
| ► | URL | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ► | BestWebSoft | Captcha |
Version: prior to version 4.3.0 |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T13:48:03.789Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "JVNDB-2017-000094",
"tags": [
"third-party-advisory",
"x_refsource_JVNDB",
"x_transferred"
],
"url": "http://jvndb.jvn.jp/jvndb/JVNDB-2017-000094"
},
{
"name": "JVN#24834813",
"tags": [
"third-party-advisory",
"x_refsource_JVN",
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN24834813/index.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Captcha",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 4.3.0"
}
]
},
{
"product": "Car Rental",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.0.5"
}
]
},
{
"product": "Contact Form Multi",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.2.1"
}
]
},
{
"product": "Contact Form",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 4.0.6"
}
]
},
{
"product": "Contact Form to DB",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.5.7"
}
]
},
{
"product": "Custom Admin Page",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 0.1.2"
}
]
},
{
"product": "Custom Fields Search",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.3.2"
}
]
},
{
"product": "Custom Search",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.36"
}
]
},
{
"product": "Donate",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 2.1.1"
}
]
},
{
"product": "Email Queue",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.1.2"
}
]
},
{
"product": "Error Log Viewer",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.0.6"
}
]
},
{
"product": "Facebook Button",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 2.54"
}
]
},
{
"product": "Featured Posts",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.0.1"
}
]
},
{
"product": "Gallery Categories",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.0.9"
}
]
},
{
"product": "Gallery",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 4.5.0"
}
]
},
{
"product": "Google +1",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.3.4"
}
]
},
{
"product": "Google AdSense",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.44"
}
]
},
{
"product": "Google Analytics",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.7.1"
}
]
},
{
"product": "Google Captcha (reCAPTCHA)",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.28"
}
]
},
{
"product": "Google Maps",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.3.6"
}
]
},
{
"product": "Google Shortlink",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.5.3"
}
]
},
{
"product": "Google Sitemap",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 3.0.8"
}
]
},
{
"product": "Htaccess",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.7.6"
}
]
},
{
"product": "Job Board",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.1.3"
}
]
},
{
"product": "Latest Posts",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 0.3"
}
]
},
{
"product": "Limit Attempts",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.1.8"
}
]
},
{
"product": "LinkedIn",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.0.5"
}
]
},
{
"product": "Multilanguage",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.2.2"
}
]
},
{
"product": "PDF \u0026 Print",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.9.4"
}
]
},
{
"product": "Pagination",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.0.7"
}
]
},
{
"product": "Pinterest",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.0.5"
}
]
},
{
"product": "Popular Posts",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.0.5"
}
]
},
{
"product": "Portfolio",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 2.4"
}
]
},
{
"product": "Post to CSV",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.3.1"
}
]
},
{
"product": "Profile Extra",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.0.7"
}
]
},
{
"product": "PromoBar",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.1.1"
}
]
},
{
"product": "Quotes and Tips",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.32"
}
]
},
{
"product": "Re-attacher",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.0.9"
}
]
},
{
"product": "Realty",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.1.0"
}
]
},
{
"product": "Relevant - Related Posts",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.2.0"
}
]
},
{
"product": "Sender",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.2.1"
}
]
},
{
"product": "SMTP",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.1.0"
}
]
},
{
"product": "Social Buttons Pack",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.1.1"
}
]
},
{
"product": "Subscriber",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.3.5"
}
]
},
{
"product": "Testimonials",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 0.1.9"
}
]
},
{
"product": "Timesheet",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 0.1.5"
}
]
},
{
"product": "Twitter Button",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 2.55"
}
]
},
{
"product": "User Role",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.5.6"
}
]
},
{
"product": "Updater",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.35"
}
]
},
{
"product": "Visitors Online",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.0.0"
}
]
},
{
"product": "Zendesk Help Center",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.0.5"
}
]
}
],
"datePublic": "2017-05-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting vulnerability in Captcha prior to version 4.3.0, Car Rental prior to version 1.0.5, Contact Form Multi prior to version 1.2.1, Contact Form prior to version 4.0.6, Contact Form to DB prior to version 1.5.7, Custom Admin Page prior to version 0.1.2, Custom Fields Search prior to version 1.3.2, Custom Search prior to version 1.36, Donate prior to version 2.1.1, Email Queue prior to version 1.1.2, Error Log Viewer prior to version 1.0.6, Facebook Button prior to version 2.54, Featured Posts prior to version 1.0.1, Gallery Categories prior to version 1.0.9, Gallery prior to version 4.5.0, Google +1 prior to version 1.3.4, Google AdSense prior to version 1.44, Google Analytics prior to version 1.7.1, Google Captcha (reCAPTCHA) prior to version 1.28, Google Maps prior to version 1.3.6, Google Shortlink prior to version 1.5.3, Google Sitemap prior to version 3.0.8, Htaccess prior to version 1.7.6, Job Board prior to version 1.1.3, Latest Posts prior to version 0.3, Limit Attempts prior to version 1.1.8, LinkedIn prior to version 1.0.5, Multilanguage prior to version 1.2.2, PDF \u0026 Print prior to version 1.9.4, Pagination prior to version 1.0.7, Pinterest prior to version 1.0.5, Popular Posts prior to version 1.0.5, Portfolio prior to version 2.4, Post to CSV prior to version 1.3.1, Profile Extra prior to version 1.0.7. PromoBar prior to version 1.1.1, Quotes and Tips prior to version 1.32, Re-attacher prior to version 1.0.9, Realty prior to version 1.1.0, Relevant - Related Posts prior to version 1.2.0, Sender prior to version 1.2.1, SMTP prior to version 1.1.0, Social Buttons Pack prior to version 1.1.1, Subscriber prior to version 1.3.5, Testimonials prior to version 0.1.9, Timesheet prior to version 0.1.5, Twitter Button prior to version 2.55, User Role prior to version 1.5.6, Updater prior to version 1.35, Visitors Online prior to version 1.0.0, and Zendesk Help Center prior to version 1.0.5 allows remote attackers to inject arbitrary web script or HTML via the function to display the BestWebSoft menu."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-site scripting",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-05-22T15:57:01",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"name": "JVNDB-2017-000094",
"tags": [
"third-party-advisory",
"x_refsource_JVNDB"
],
"url": "http://jvndb.jvn.jp/jvndb/JVNDB-2017-000094"
},
{
"name": "JVN#24834813",
"tags": [
"third-party-advisory",
"x_refsource_JVN"
],
"url": "https://jvn.jp/en/jp/JVN24834813/index.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "vultures@jpcert.or.jp",
"ID": "CVE-2017-2171",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Captcha",
"version": {
"version_data": [
{
"version_value": "prior to version 4.3.0"
}
]
}
},
{
"product_name": "Car Rental",
"version": {
"version_data": [
{
"version_value": "prior to version 1.0.5"
}
]
}
},
{
"product_name": "Contact Form Multi",
"version": {
"version_data": [
{
"version_value": "prior to version 1.2.1"
}
]
}
},
{
"product_name": "Contact Form",
"version": {
"version_data": [
{
"version_value": "prior to version 4.0.6"
}
]
}
},
{
"product_name": "Contact Form to DB",
"version": {
"version_data": [
{
"version_value": "prior to version 1.5.7"
}
]
}
},
{
"product_name": "Custom Admin Page",
"version": {
"version_data": [
{
"version_value": "prior to version 0.1.2"
}
]
}
},
{
"product_name": "Custom Fields Search",
"version": {
"version_data": [
{
"version_value": "prior to version 1.3.2"
}
]
}
},
{
"product_name": "Custom Search",
"version": {
"version_data": [
{
"version_value": "prior to version 1.36"
}
]
}
},
{
"product_name": "Donate",
"version": {
"version_data": [
{
"version_value": "prior to version 2.1.1"
}
]
}
},
{
"product_name": "Email Queue",
"version": {
"version_data": [
{
"version_value": "prior to version 1.1.2"
}
]
}
},
{
"product_name": "Error Log Viewer",
"version": {
"version_data": [
{
"version_value": "prior to version 1.0.6"
}
]
}
},
{
"product_name": "Facebook Button",
"version": {
"version_data": [
{
"version_value": "prior to version 2.54"
}
]
}
},
{
"product_name": "Featured Posts",
"version": {
"version_data": [
{
"version_value": "prior to version 1.0.1"
}
]
}
},
{
"product_name": "Gallery Categories",
"version": {
"version_data": [
{
"version_value": "prior to version 1.0.9"
}
]
}
},
{
"product_name": "Gallery",
"version": {
"version_data": [
{
"version_value": "prior to version 4.5.0"
}
]
}
},
{
"product_name": "Google +1",
"version": {
"version_data": [
{
"version_value": "prior to version 1.3.4"
}
]
}
},
{
"product_name": "Google AdSense",
"version": {
"version_data": [
{
"version_value": "prior to version 1.44"
}
]
}
},
{
"product_name": "Google Analytics",
"version": {
"version_data": [
{
"version_value": "prior to version 1.7.1"
}
]
}
},
{
"product_name": "Google Captcha (reCAPTCHA)",
"version": {
"version_data": [
{
"version_value": "prior to version 1.28"
}
]
}
},
{
"product_name": "Google Maps",
"version": {
"version_data": [
{
"version_value": "prior to version 1.3.6"
}
]
}
},
{
"product_name": "Google Shortlink",
"version": {
"version_data": [
{
"version_value": "prior to version 1.5.3"
}
]
}
},
{
"product_name": "Google Sitemap",
"version": {
"version_data": [
{
"version_value": "prior to version 3.0.8"
}
]
}
},
{
"product_name": "Htaccess",
"version": {
"version_data": [
{
"version_value": "prior to version 1.7.6"
}
]
}
},
{
"product_name": "Job Board",
"version": {
"version_data": [
{
"version_value": "prior to version 1.1.3"
}
]
}
},
{
"product_name": "Latest Posts",
"version": {
"version_data": [
{
"version_value": "prior to version 0.3"
}
]
}
},
{
"product_name": "Limit Attempts",
"version": {
"version_data": [
{
"version_value": "prior to version 1.1.8"
}
]
}
},
{
"product_name": "LinkedIn",
"version": {
"version_data": [
{
"version_value": "prior to version 1.0.5"
}
]
}
},
{
"product_name": "Multilanguage",
"version": {
"version_data": [
{
"version_value": "prior to version 1.2.2"
}
]
}
},
{
"product_name": "PDF \u0026 Print",
"version": {
"version_data": [
{
"version_value": "prior to version 1.9.4"
}
]
}
},
{
"product_name": "Pagination",
"version": {
"version_data": [
{
"version_value": "prior to version 1.0.7"
}
]
}
},
{
"product_name": "Pinterest",
"version": {
"version_data": [
{
"version_value": "prior to version 1.0.5"
}
]
}
},
{
"product_name": "Popular Posts",
"version": {
"version_data": [
{
"version_value": "prior to version 1.0.5"
}
]
}
},
{
"product_name": "Portfolio",
"version": {
"version_data": [
{
"version_value": "prior to version 2.4"
}
]
}
},
{
"product_name": "Post to CSV",
"version": {
"version_data": [
{
"version_value": "prior to version 1.3.1"
}
]
}
},
{
"product_name": "Profile Extra",
"version": {
"version_data": [
{
"version_value": "prior to version 1.0.7"
}
]
}
},
{
"product_name": "PromoBar",
"version": {
"version_data": [
{
"version_value": "prior to version 1.1.1"
}
]
}
},
{
"product_name": "Quotes and Tips",
"version": {
"version_data": [
{
"version_value": "prior to version 1.32"
}
]
}
},
{
"product_name": "Re-attacher",
"version": {
"version_data": [
{
"version_value": "prior to version 1.0.9"
}
]
}
},
{
"product_name": "Realty",
"version": {
"version_data": [
{
"version_value": "prior to version 1.1.0"
}
]
}
},
{
"product_name": "Relevant - Related Posts",
"version": {
"version_data": [
{
"version_value": "prior to version 1.2.0"
}
]
}
},
{
"product_name": "Sender",
"version": {
"version_data": [
{
"version_value": "prior to version 1.2.1"
}
]
}
},
{
"product_name": "SMTP",
"version": {
"version_data": [
{
"version_value": "prior to version 1.1.0"
}
]
}
},
{
"product_name": "Social Buttons Pack",
"version": {
"version_data": [
{
"version_value": "prior to version 1.1.1"
}
]
}
},
{
"product_name": "Subscriber",
"version": {
"version_data": [
{
"version_value": "prior to version 1.3.5"
}
]
}
},
{
"product_name": "Testimonials",
"version": {
"version_data": [
{
"version_value": "prior to version 0.1.9"
}
]
}
},
{
"product_name": "Timesheet",
"version": {
"version_data": [
{
"version_value": "prior to version 0.1.5"
}
]
}
},
{
"product_name": "Twitter Button",
"version": {
"version_data": [
{
"version_value": "prior to version 2.55"
}
]
}
},
{
"product_name": "User Role",
"version": {
"version_data": [
{
"version_value": "prior to version 1.5.6"
}
]
}
},
{
"product_name": "Updater",
"version": {
"version_data": [
{
"version_value": "prior to version 1.35"
}
]
}
},
{
"product_name": "Visitors Online",
"version": {
"version_data": [
{
"version_value": "prior to version 1.0.0"
}
]
}
},
{
"product_name": "Zendesk Help Center",
"version": {
"version_data": [
{
"version_value": "prior to version 1.0.5"
}
]
}
}
]
},
"vendor_name": "BestWebSoft"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting vulnerability in Captcha prior to version 4.3.0, Car Rental prior to version 1.0.5, Contact Form Multi prior to version 1.2.1, Contact Form prior to version 4.0.6, Contact Form to DB prior to version 1.5.7, Custom Admin Page prior to version 0.1.2, Custom Fields Search prior to version 1.3.2, Custom Search prior to version 1.36, Donate prior to version 2.1.1, Email Queue prior to version 1.1.2, Error Log Viewer prior to version 1.0.6, Facebook Button prior to version 2.54, Featured Posts prior to version 1.0.1, Gallery Categories prior to version 1.0.9, Gallery prior to version 4.5.0, Google +1 prior to version 1.3.4, Google AdSense prior to version 1.44, Google Analytics prior to version 1.7.1, Google Captcha (reCAPTCHA) prior to version 1.28, Google Maps prior to version 1.3.6, Google Shortlink prior to version 1.5.3, Google Sitemap prior to version 3.0.8, Htaccess prior to version 1.7.6, Job Board prior to version 1.1.3, Latest Posts prior to version 0.3, Limit Attempts prior to version 1.1.8, LinkedIn prior to version 1.0.5, Multilanguage prior to version 1.2.2, PDF \u0026 Print prior to version 1.9.4, Pagination prior to version 1.0.7, Pinterest prior to version 1.0.5, Popular Posts prior to version 1.0.5, Portfolio prior to version 2.4, Post to CSV prior to version 1.3.1, Profile Extra prior to version 1.0.7. PromoBar prior to version 1.1.1, Quotes and Tips prior to version 1.32, Re-attacher prior to version 1.0.9, Realty prior to version 1.1.0, Relevant - Related Posts prior to version 1.2.0, Sender prior to version 1.2.1, SMTP prior to version 1.1.0, Social Buttons Pack prior to version 1.1.1, Subscriber prior to version 1.3.5, Testimonials prior to version 0.1.9, Timesheet prior to version 0.1.5, Twitter Button prior to version 2.55, User Role prior to version 1.5.6, Updater prior to version 1.35, Visitors Online prior to version 1.0.0, and Zendesk Help Center prior to version 1.0.5 allows remote attackers to inject arbitrary web script or HTML via the function to display the BestWebSoft menu."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Cross-site scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "JVNDB-2017-000094",
"refsource": "JVNDB",
"url": "http://jvndb.jvn.jp/jvndb/JVNDB-2017-000094"
},
{
"name": "JVN#24834813",
"refsource": "JVN",
"url": "https://jvn.jp/en/jp/JVN24834813/index.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2017-2171",
"datePublished": "2017-05-22T16:00:00",
"dateReserved": "2016-12-01T00:00:00",
"dateUpdated": "2024-08-05T13:48:03.789Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Vulnerability from fkie_nvd
Published
2019-08-13 17:15
Modified
2024-11-21 02:44
Severity ?
Summary
The contact-form-plugin plugin before 4.0.2 for WordPress has XSS.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://wordpress.org/plugins/contact-form-plugin/#developers | Release Notes, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://wordpress.org/plugins/contact-form-plugin/#developers | Release Notes, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bestwebsoft | contact_form | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bestwebsoft:contact_form:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "901FDBE7-264F-42A3-ADE1-FE6FB21E3F76",
"versionEndExcluding": "4.0.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The contact-form-plugin plugin before 4.0.2 for WordPress has XSS."
},
{
"lang": "es",
"value": "El complemento contact-form-plugin anterior de 4.0.2 para WordPress tiene XSS"
}
],
"id": "CVE-2016-10869",
"lastModified": "2024-11-21T02:44:56.950",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-08-13T17:15:12.297",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-08-13 17:15
Modified
2024-11-21 03:20
Severity ?
Summary
The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://wordpress.org/plugins/contact-form-plugin/#developers | Release Notes, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://wordpress.org/plugins/contact-form-plugin/#developers | Release Notes, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bestwebsoft | contact_form | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bestwebsoft:contact_form:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "89380FF9-A53C-4E85-8806-49B07B2CFBCE",
"versionEndExcluding": "4.0.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues."
},
{
"lang": "es",
"value": "El complemento contact-form-plugin anterior de 4.0.6 para WordPress tiene m\u00faltiples problemas XSS."
}
],
"id": "CVE-2017-18491",
"lastModified": "2024-11-21T03:20:14.610",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-08-13T17:15:13.220",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-04-05 13:15
Modified
2024-11-21 01:48
Severity ?
3.5 (Low) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
A vulnerability, which was classified as problematic, has been found in BestWebSoft Contact Form Plugin 3.51 on WordPress. Affected by this issue is the function cntctfrm_display_form/cntctfrm_check_form of the file contact_form.php. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 3.52 is able to address this issue. The patch is identified as 642ef1dc1751ab6642ce981fe126325bb574f898. It is recommended to upgrade the affected component. VDB-225002 is the identifier assigned to this vulnerability.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cna@vuldb.com | https://github.com/wp-plugins/contact-form-plugin/commit/642ef1dc1751ab6642ce981fe126325bb574f898 | Patch | |
| cna@vuldb.com | https://vuldb.com/?ctiid.225002 | Permissions Required, Third Party Advisory, VDB Entry | |
| cna@vuldb.com | https://vuldb.com/?id.225002 | Permissions Required, Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/wp-plugins/contact-form-plugin/commit/642ef1dc1751ab6642ce981fe126325bb574f898 | Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | https://vuldb.com/?ctiid.225002 | Permissions Required, Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://vuldb.com/?id.225002 | Permissions Required, Third Party Advisory, VDB Entry |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bestwebsoft | contact_form | 3.51 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bestwebsoft:contact_form:3.51:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "6B54FAC3-D664-419A-9E2B-8A93FE738A35",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability, which was classified as problematic, has been found in BestWebSoft Contact Form Plugin 3.51 on WordPress. Affected by this issue is the function cntctfrm_display_form/cntctfrm_check_form of the file contact_form.php. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 3.52 is able to address this issue. The patch is identified as 642ef1dc1751ab6642ce981fe126325bb574f898. It is recommended to upgrade the affected component. VDB-225002 is the identifier assigned to this vulnerability."
}
],
"id": "CVE-2013-10022",
"lastModified": "2024-11-21T01:48:41.130",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "cna@vuldb.com",
"type": "Secondary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.1,
"impactScore": 1.4,
"source": "cna@vuldb.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-04-05T13:15:06.830",
"references": [
{
"source": "cna@vuldb.com",
"tags": [
"Patch"
],
"url": "https://github.com/wp-plugins/contact-form-plugin/commit/642ef1dc1751ab6642ce981fe126325bb574f898"
},
{
"source": "cna@vuldb.com",
"tags": [
"Permissions Required",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://vuldb.com/?ctiid.225002"
},
{
"source": "cna@vuldb.com",
"tags": [
"Permissions Required",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://vuldb.com/?id.225002"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/wp-plugins/contact-form-plugin/commit/642ef1dc1751ab6642ce981fe126325bb574f898"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Permissions Required",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://vuldb.com/?ctiid.225002"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Permissions Required",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://vuldb.com/?id.225002"
}
],
"sourceIdentifier": "cna@vuldb.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "cna@vuldb.com",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2017-05-22 16:29
Modified
2025-04-20 01:37
Severity ?
Summary
Cross-site scripting vulnerability in Captcha prior to version 4.3.0, Car Rental prior to version 1.0.5, Contact Form Multi prior to version 1.2.1, Contact Form prior to version 4.0.6, Contact Form to DB prior to version 1.5.7, Custom Admin Page prior to version 0.1.2, Custom Fields Search prior to version 1.3.2, Custom Search prior to version 1.36, Donate prior to version 2.1.1, Email Queue prior to version 1.1.2, Error Log Viewer prior to version 1.0.6, Facebook Button prior to version 2.54, Featured Posts prior to version 1.0.1, Gallery Categories prior to version 1.0.9, Gallery prior to version 4.5.0, Google +1 prior to version 1.3.4, Google AdSense prior to version 1.44, Google Analytics prior to version 1.7.1, Google Captcha (reCAPTCHA) prior to version 1.28, Google Maps prior to version 1.3.6, Google Shortlink prior to version 1.5.3, Google Sitemap prior to version 3.0.8, Htaccess prior to version 1.7.6, Job Board prior to version 1.1.3, Latest Posts prior to version 0.3, Limit Attempts prior to version 1.1.8, LinkedIn prior to version 1.0.5, Multilanguage prior to version 1.2.2, PDF & Print prior to version 1.9.4, Pagination prior to version 1.0.7, Pinterest prior to version 1.0.5, Popular Posts prior to version 1.0.5, Portfolio prior to version 2.4, Post to CSV prior to version 1.3.1, Profile Extra prior to version 1.0.7. PromoBar prior to version 1.1.1, Quotes and Tips prior to version 1.32, Re-attacher prior to version 1.0.9, Realty prior to version 1.1.0, Relevant - Related Posts prior to version 1.2.0, Sender prior to version 1.2.1, SMTP prior to version 1.1.0, Social Buttons Pack prior to version 1.1.1, Subscriber prior to version 1.3.5, Testimonials prior to version 0.1.9, Timesheet prior to version 0.1.5, Twitter Button prior to version 2.55, User Role prior to version 1.5.6, Updater prior to version 1.35, Visitors Online prior to version 1.0.0, and Zendesk Help Center prior to version 1.0.5 allows remote attackers to inject arbitrary web script or HTML via the function to display the BestWebSoft menu.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| vultures@jpcert.or.jp | http://jvndb.jvn.jp/jvndb/JVNDB-2017-000094 | Third Party Advisory, VDB Entry | |
| vultures@jpcert.or.jp | https://jvn.jp/en/jp/JVN24834813/index.html | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | http://jvndb.jvn.jp/jvndb/JVNDB-2017-000094 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jvn.jp/en/jp/JVN24834813/index.html | Third Party Advisory, VDB Entry |
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bestwebsoft:captcha:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "90F44502-FB47-4A8C-85E0-1D2F7CEB4F8F",
"versionEndIncluding": "4.2.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:car_rental:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "7FD9118E-F65C-4F96-A03D-87EF15FE4DB8",
"versionEndIncluding": "1.0.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:contact_form:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "AA683363-7D2C-40FC-AFC1-8BB0D7E3AF60",
"versionEndIncluding": "4.0.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:contact_form_multi:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "2C300FBE-4C10-402E-9DFD-9C2A0E241684",
"versionEndIncluding": "1.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:contact_form_to_db:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "E74A735C-9771-42FE-91CF-2EE118BE5754",
"versionEndIncluding": "1.5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:custom_admin_page:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "567A9DFD-5848-4A84-8787-CC21DEDF3A20",
"versionEndIncluding": "0.1.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:custom_fields_search:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "A2B55BB7-BAA3-4A64-86B0-D0B1B0AE1790",
"versionEndIncluding": "1.3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:custom_search:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "417CA792-0359-484F-873D-CC1B1367EA76",
"versionEndIncluding": "1.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:donate:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "DFD8E82F-C24A-4038-9B08-CEEF5CBBC42B",
"versionEndIncluding": "2.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:email_queue:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "89F8B416-6BFD-48D7-B93E-CAB63DE9186B",
"versionEndIncluding": "1.1.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:error_log_viewer:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "2A209B67-5AF3-43B3-882A-EB19FACDF92F",
"versionEndIncluding": "1.0.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:facebook_button:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "654AE23F-C9D4-4C7E-B224-7F3C6928BA26",
"versionEndIncluding": "2.53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:featured_posts:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "988E8170-1CBF-4ADC-996C-AABFB01BA651",
"versionEndIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:gallery:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "2B96D453-8969-450C-9C65-AB3F7AEEBB4E",
"versionEndIncluding": "4.4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:gallery_categories:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "22A425FD-B64C-4838-B444-E360EC3CC165",
"versionEndIncluding": "1.0.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:google_\\+1:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "7254F701-8040-4333-9176-485C933B91C2",
"versionEndIncluding": "1.3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:google_adsense:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "C2E35767-7306-4629-8D52-25473261C6D1",
"versionEndIncluding": "1.43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:google_analytics:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "8EB86D06-FE0E-4F27-BD0C-DF8F14683C82",
"versionEndIncluding": "1.7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:google_captcha_\\(recaptcha\\):*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "41305158-20F3-4981-A225-DA6098D29787",
"versionEndIncluding": "1.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:google_maps:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "8D441016-C8FA-46EE-A5C9-1BC59C0300BC",
"versionEndIncluding": "1.3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:google_shortlink:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "E9D74A48-AA12-4144-9E58-629B0453F2E5",
"versionEndIncluding": "1.5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:google_sitemap:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "76055B18-196C-40E7-9ED0-08757BF02294",
"versionEndIncluding": "3.0.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:htaccess:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "9AD12F58-D0AE-4C81-A462-77B773AC6C01",
"versionEndIncluding": "1.7.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:job_board:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "1E7291C6-8894-445E-8D1F-F7E0B81B7413",
"versionEndIncluding": "1.1.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:latest_posts:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "2E923F7E-6E06-4D71-A6BD-DD3F5C9ACE09",
"versionEndIncluding": "0.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:limit_attempts:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "4523ADEB-335E-4F85-BB9C-F9067FE7704E",
"versionEndIncluding": "1.1.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:linkedin:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "7C68F2B6-7703-4D1A-9F65-84AFA2A1399C",
"versionEndIncluding": "1.0.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:multilanguage:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "C18F489C-D0D5-4E52-8676-A9AA54E0F4D8",
"versionEndIncluding": "1.2.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:pagination:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "9ACAF0C2-2F33-428A-82C3-033008BA53E5",
"versionEndIncluding": "1.0.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:pdf_\\\u0026_print:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "15CACB57-172A-4D72-945B-2E558C4306A1",
"versionEndIncluding": "1.9.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:pinterest:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "128A8B29-44E3-48E2-9B35-647CFDB4B2CF",
"versionEndIncluding": "1.0.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:popular_posts:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "E5142C57-41B0-4C34-8D67-1B0E74E85823",
"versionEndIncluding": "1.0.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:portfolio:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "4BB616C1-FB02-4C36-8404-2B51174E0643",
"versionEndIncluding": "2.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:post_to_csv:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "C7BD7BC4-26C8-44CC-BA11-FBD08C60BDDB",
"versionEndIncluding": "1.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:profile_extra:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "A9B6AF6B-7C61-4710-8E20-5260B8BB8587",
"versionEndIncluding": "1.0.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:promobar:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "66EBAC9C-9BDF-4CE0-A6DF-F86B60749EBC",
"versionEndIncluding": "1.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:quotes_and_tips:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "A155BC6E-80DC-4B1F-91BC-91F46EFDB7B0",
"versionEndIncluding": "1.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:re-attacher:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "D5244EC0-B74E-4621-8A35-1303A66FBB77",
"versionEndIncluding": "1.0.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:realty:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "7B3D5561-7C8A-4F10-A94C-3B107E859C9F",
"versionEndIncluding": "1.0.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:relevant_-_related_posts:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "13C5ADFE-9E5F-4B6D-868C-1E5561BCA735",
"versionEndIncluding": "1.1.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:sender:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "E2FEB44F-6295-47DA-A8E1-A98C91D7B3D4",
"versionEndIncluding": "1.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:smtp:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "C31637E1-2B26-41D3-9C48-30909192C4C1",
"versionEndIncluding": "1.0.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:social_buttons_pack:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "3F00CBC2-5171-47ED-8E4D-B5F5AE6F2D5D",
"versionEndIncluding": "1.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:subscriber:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "7780A47F-094A-4F9C-AF4E-9C77CDF0ABDE",
"versionEndIncluding": "1.3.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:testimonials:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "9936ACD0-1E2E-4E14-B83E-E4967DA9E546",
"versionEndIncluding": "0.1.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:timesheet:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "7AF2B2E4-0563-4FB3-83AA-4A219EB41036",
"versionEndIncluding": "0.1.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:twitter_button:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "F0CF502E-87F7-4B64-B123-EF610ABAC15D",
"versionEndIncluding": "2.54",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:updater:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "1E817AF1-87E3-43A6-86F6-69C585790F47",
"versionEndIncluding": "1.34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:user_role:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "97AD540F-5775-4F84-AAA5-175C947BB34E",
"versionEndIncluding": "1.5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:visitors_online:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "61A05396-59CD-475A-A4D5-009B591C6BA4",
"versionEndIncluding": "0.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bestwebsoft:zendesk_help_center:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "6F4D196B-0578-44BA-A2C3-10F1C4D395F8",
"versionEndIncluding": "1.0.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting vulnerability in Captcha prior to version 4.3.0, Car Rental prior to version 1.0.5, Contact Form Multi prior to version 1.2.1, Contact Form prior to version 4.0.6, Contact Form to DB prior to version 1.5.7, Custom Admin Page prior to version 0.1.2, Custom Fields Search prior to version 1.3.2, Custom Search prior to version 1.36, Donate prior to version 2.1.1, Email Queue prior to version 1.1.2, Error Log Viewer prior to version 1.0.6, Facebook Button prior to version 2.54, Featured Posts prior to version 1.0.1, Gallery Categories prior to version 1.0.9, Gallery prior to version 4.5.0, Google +1 prior to version 1.3.4, Google AdSense prior to version 1.44, Google Analytics prior to version 1.7.1, Google Captcha (reCAPTCHA) prior to version 1.28, Google Maps prior to version 1.3.6, Google Shortlink prior to version 1.5.3, Google Sitemap prior to version 3.0.8, Htaccess prior to version 1.7.6, Job Board prior to version 1.1.3, Latest Posts prior to version 0.3, Limit Attempts prior to version 1.1.8, LinkedIn prior to version 1.0.5, Multilanguage prior to version 1.2.2, PDF \u0026 Print prior to version 1.9.4, Pagination prior to version 1.0.7, Pinterest prior to version 1.0.5, Popular Posts prior to version 1.0.5, Portfolio prior to version 2.4, Post to CSV prior to version 1.3.1, Profile Extra prior to version 1.0.7. PromoBar prior to version 1.1.1, Quotes and Tips prior to version 1.32, Re-attacher prior to version 1.0.9, Realty prior to version 1.1.0, Relevant - Related Posts prior to version 1.2.0, Sender prior to version 1.2.1, SMTP prior to version 1.1.0, Social Buttons Pack prior to version 1.1.1, Subscriber prior to version 1.3.5, Testimonials prior to version 0.1.9, Timesheet prior to version 0.1.5, Twitter Button prior to version 2.55, User Role prior to version 1.5.6, Updater prior to version 1.35, Visitors Online prior to version 1.0.0, and Zendesk Help Center prior to version 1.0.5 allows remote attackers to inject arbitrary web script or HTML via the function to display the BestWebSoft menu."
},
{
"lang": "es",
"value": "Una Vulnerabilidad de tipo cross-site-scripting en Captcha anterior a versi\u00f3n 4.3.0, Car Rental anterior a versi\u00f3n 1.0.5, Contact Form Multi anterior a versi\u00f3n 1.2.1, Contact Form anterior a versi\u00f3n 4.0.6, Contact Form to DB anterior a versi\u00f3n 1.5.7, Custom Admin Page anterior a versi\u00f3n 0.1.2, Custom Fields Search anterior a versi\u00f3n 1.3.2, Custom Search anterior a versi\u00f3n 1.36, Donate anterior a versi\u00f3n 2.1.1, Email Queue anterior a versi\u00f3n 1.1.2, Error Log Viewer anterior a versi\u00f3n 1.0.6, Facebook Button anterior a versi\u00f3n 2.54, Featured Posts anterior a versi\u00f3n 1.0.1, Gallery Categories anterior a versi\u00f3n 1.0.9, Gallery anterior a versi\u00f3n 4.5.0, Google +1 anterior a versi\u00f3n 1.3.4, Google AdSense anterior a versi\u00f3n 1.44, Google Analytics anterior a versi\u00f3n 1.7.1, Google Captcha (reCAPTCHA) anterior a versi\u00f3n 1.28, Google Maps anterior a versi\u00f3n 1.3.6, Google Shortlink anterior a versi\u00f3n 1.5.3, Google Sitemap anterior a versi\u00f3n 3.0.8, Htaccess anterior a versi\u00f3n 1.7.6, Job Board anterior a versi\u00f3n 1.1.3, Latest Posts anterior a versi\u00f3n 0.3, Limit Attempts anterior a versi\u00f3n 1.1.8, LinkedIn anterior a versi\u00f3n 1.0.5, Multilanguage anterior a versi\u00f3n 1.2.2, PDF \u0026 Print anterior a versi\u00f3n 1.9.4, Pagination anterior a versi\u00f3n 1.0.7, Pinterest anterior a versi\u00f3n 1.0.5, Popular Posts anteriores a versi\u00f3n 1.0.5, Portfolio anterior a la versi\u00f3n 2.4, Post to CSV anterior a versi\u00f3n 1.3.1, Profile Extra anterior a versi\u00f3n 1.0.7. PromoBar anterior a versi\u00f3n 1.1.1, Quotes and Tips anterior a versi\u00f3n 1.32, Re-attacher anterior a versi\u00f3n 1.0.9, Realty anterior a versi\u00f3n 1.1.0, Relevant - Related Posts anterior a versi\u00f3n 1.2.0, Sender anterior a versi\u00f3n 1.2.1, SMTP anterior a versi\u00f3n 1.1.0, Social Buttons Pack anterior a versi\u00f3n 1.1.1, Subscriber anterior a versi\u00f3n 1.3.5, Testimonials anteriores a versi\u00f3n 0.1.9, Timesheet anterior a versi\u00f3n 0.1.5, Twitter Button anterior a versi\u00f3n 2.55, User Role anterior a versi\u00f3n 1.5.6, Updater anterior a versi\u00f3n 1.35, Visitors Online anterior a versi\u00f3n 1.0.0, y Zendesk Help Center anterior a versi\u00f3n 1.0.5, permite a los atacantes remotos inyectar script web o HTML arbitrario por medio de la funci\u00f3n para mostrar el men\u00fa BestWebSoft."
}
],
"id": "CVE-2017-2171",
"lastModified": "2025-04-20T01:37:25.860",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-05-22T16:29:00.747",
"references": [
{
"source": "vultures@jpcert.or.jp",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://jvndb.jvn.jp/jvndb/JVNDB-2017-000094"
},
{
"source": "vultures@jpcert.or.jp",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "https://jvn.jp/en/jp/JVN24834813/index.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://jvndb.jvn.jp/jvndb/JVNDB-2017-000094"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "https://jvn.jp/en/jp/JVN24834813/index.html"
}
],
"sourceIdentifier": "vultures@jpcert.or.jp",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
},
{
"lang": "en",
"value": "CWE-91"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2024-04-09 19:15
Modified
2025-04-07 13:28
Severity ?
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
The Contact Form by BestWebSoft plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘cntctfrm_contact_subject’ parameter in all versions up to, and including, 4.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bestwebsoft | contact_form | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bestwebsoft:contact_form:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "79689E67-A589-4ADA-9DF9-BE8B1FBE48AA",
"versionEndExcluding": "4.2.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Contact Form by BestWebSoft plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u2018cntctfrm_contact_subject\u2019 parameter in all versions up to, and including, 4.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."
},
{
"lang": "es",
"value": "El complemento Contact Form de BestWebSoft para WordPress es vulnerable a Reflected Cross-Site Scripting a trav\u00e9s del par\u00e1metro \u0027cntctfrm_contact_subject\u0027 en todas las versiones hasta la 4.2.8 incluida debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes. Esto hace posible que atacantes no autenticados inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutan si logran enga\u00f1ar a un usuario para que realice una acci\u00f3n como hacer clic en un enlace."
}
],
"id": "CVE-2024-2200",
"lastModified": "2025-04-07T13:28:48.983",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "security@wordfence.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
},
"published": "2024-04-09T19:15:29.960",
"references": [
{
"source": "security@wordfence.com",
"tags": [
"Patch"
],
"url": "https://plugins.trac.wordpress.org/changeset/3047840/contact-form-plugin"
},
{
"source": "security@wordfence.com",
"tags": [
"Third Party Advisory"
],
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/28524702-3428-4fca-afe8-71b3f2dd983d?source=cve"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://plugins.trac.wordpress.org/changeset/3047840/contact-form-plugin"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/28524702-3428-4fca-afe8-71b3f2dd983d?source=cve"
}
],
"sourceIdentifier": "security@wordfence.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-08-22 13:15
Modified
2024-11-21 02:01
Severity ?
Summary
The contact-form-plugin plugin before 3.3.5 for WordPress has XSS.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://wordpress.org/plugins/contact-form-plugin/#developers | Release Notes, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://wordpress.org/plugins/contact-form-plugin/#developers | Release Notes, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bestwebsoft | contact_form | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bestwebsoft:contact_form:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "50B3EB03-6367-40E5-BBDF-0FFD54A25FF7",
"versionEndExcluding": "3.3.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The contact-form-plugin plugin before 3.3.5 for WordPress has XSS."
},
{
"lang": "es",
"value": "El plugin contact-form-plugin versiones anteriores a 3.3.5 para WordPress, presenta una vulnerabilidad de tipo XSS."
}
],
"id": "CVE-2013-7481",
"lastModified": "2024-11-21T02:01:06.950",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-08-22T13:15:11.403",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-06-16 13:15
Modified
2024-11-21 03:22
Severity ?
3.5 (Low) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Summary
A vulnerability classified as problematic has been found in BestWebSoft Contact Form Plugin 4.0.0. This affects an unknown part. The manipulation leads to basic cross site scripting (Stored). It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.0.2 is able to address this issue. It is recommended to upgrade the affected component.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cna@vuldb.com | http://seclists.org/fulldisclosure/2017/Feb/100 | Exploit, Mailing List, Third Party Advisory | |
| cna@vuldb.com | https://sumofpwn.nl/advisory/2016/stored_cross_site_scripting_vulnerability_in_contact_form_wordpress_plugin.html | Exploit, Third Party Advisory | |
| cna@vuldb.com | https://vuldb.com/?id.97389 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://seclists.org/fulldisclosure/2017/Feb/100 | Exploit, Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://sumofpwn.nl/advisory/2016/stored_cross_site_scripting_vulnerability_in_contact_form_wordpress_plugin.html | Exploit, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://vuldb.com/?id.97389 | Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bestwebsoft | contact_form | 4.0.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bestwebsoft:contact_form:4.0.0:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "AB10F929-3A82-4BBF-8CA4-5628D8F26548",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability classified as problematic has been found in BestWebSoft Contact Form Plugin 4.0.0. This affects an unknown part. The manipulation leads to basic cross site scripting (Stored). It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.0.2 is able to address this issue. It is recommended to upgrade the affected component."
},
{
"lang": "es",
"value": "Se ha encontrado una vulnerabilidad clasificada como problem\u00e1tica en BestWebSoft Contact Form Plugin versi\u00f3n 4.0.0. Esto afecta a una parte desconocida. La manipulaci\u00f3n conlleva a un ataque de tipo cross site scripting b\u00e1sico (almacenado). Es posible iniciar el ataque de forma remota. La explotaci\u00f3n ha sido revelada al p\u00fablico y puede ser usada. La actualizaci\u00f3n a versi\u00f3n 4.0.2 puede abordar este problema. Es recomendado actualizar el componente afectado"
}
],
"id": "CVE-2017-20055",
"lastModified": "2024-11-21T03:22:32.030",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.1,
"impactScore": 1.4,
"source": "cna@vuldb.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-06-16T13:15:08.073",
"references": [
{
"source": "cna@vuldb.com",
"tags": [
"Exploit",
"Mailing List",
"Third Party Advisory"
],
"url": "http://seclists.org/fulldisclosure/2017/Feb/100"
},
{
"source": "cna@vuldb.com",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://sumofpwn.nl/advisory/2016/stored_cross_site_scripting_vulnerability_in_contact_form_wordpress_plugin.html"
},
{
"source": "cna@vuldb.com",
"tags": [
"Third Party Advisory"
],
"url": "https://vuldb.com/?id.97389"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Mailing List",
"Third Party Advisory"
],
"url": "http://seclists.org/fulldisclosure/2017/Feb/100"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://sumofpwn.nl/advisory/2016/stored_cross_site_scripting_vulnerability_in_contact_form_wordpress_plugin.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://vuldb.com/?id.97389"
}
],
"sourceIdentifier": "cna@vuldb.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-80"
}
],
"source": "cna@vuldb.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-04-09 06:15
Modified
2024-11-21 02:03
Severity ?
3.5 (Low) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
A vulnerability was found in BestWebSoft Contact Form Plugin 1.3.4 on WordPress and classified as problematic. Affected by this issue is the function bws_add_menu_render of the file bws_menu/bws_menu.php. The manipulation of the argument bwsmn_form_email leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.3.7 is able to address this issue. The name of the patch is 4d531f74b4a801c805dc80360d4ea1312e9a278f. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-225320.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cna@vuldb.com | https://github.com/wp-plugins/contact-form-plugin/commit/4d531f74b4a801c805dc80360d4ea1312e9a278f | Patch | |
| cna@vuldb.com | https://vuldb.com/?ctiid.225320 | Permissions Required, Third Party Advisory | |
| cna@vuldb.com | https://vuldb.com/?id.225320 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/wp-plugins/contact-form-plugin/commit/4d531f74b4a801c805dc80360d4ea1312e9a278f | Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | https://vuldb.com/?ctiid.225320 | Permissions Required, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://vuldb.com/?id.225320 | Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bestwebsoft | contact_form | 1.3.4 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bestwebsoft:contact_form:1.3.4:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "2832D0DD-B8C6-4F99-AF8E-289D56CE8327",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in BestWebSoft Contact Form Plugin 1.3.4 on WordPress and classified as problematic. Affected by this issue is the function bws_add_menu_render of the file bws_menu/bws_menu.php. The manipulation of the argument bwsmn_form_email leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.3.7 is able to address this issue. The name of the patch is 4d531f74b4a801c805dc80360d4ea1312e9a278f. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-225320."
}
],
"id": "CVE-2014-125095",
"lastModified": "2024-11-21T02:03:47.447",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "cna@vuldb.com",
"type": "Secondary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.1,
"impactScore": 1.4,
"source": "cna@vuldb.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-04-09T06:15:10.593",
"references": [
{
"source": "cna@vuldb.com",
"tags": [
"Patch"
],
"url": "https://github.com/wp-plugins/contact-form-plugin/commit/4d531f74b4a801c805dc80360d4ea1312e9a278f"
},
{
"source": "cna@vuldb.com",
"tags": [
"Permissions Required",
"Third Party Advisory"
],
"url": "https://vuldb.com/?ctiid.225320"
},
{
"source": "cna@vuldb.com",
"tags": [
"Third Party Advisory"
],
"url": "https://vuldb.com/?id.225320"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/wp-plugins/contact-form-plugin/commit/4d531f74b4a801c805dc80360d4ea1312e9a278f"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Permissions Required",
"Third Party Advisory"
],
"url": "https://vuldb.com/?ctiid.225320"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://vuldb.com/?id.225320"
}
],
"sourceIdentifier": "cna@vuldb.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "cna@vuldb.com",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-08-13 17:15
Modified
2024-11-21 02:40
Severity ?
Summary
The contact-form-plugin plugin before 3.96 for WordPress has XSS.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://wordpress.org/plugins/contact-form-plugin/#developers | Release Notes, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://wordpress.org/plugins/contact-form-plugin/#developers | Release Notes, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bestwebsoft | contact_form | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bestwebsoft:contact_form:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "43C08F3E-A651-4A59-9998-63A5EC116004",
"versionEndExcluding": "3.96",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The contact-form-plugin plugin before 3.96 for WordPress has XSS."
},
{
"lang": "es",
"value": "El complemento contact-form-plugin anterior a 3.96 para WordPress tiene XSS."
}
],
"id": "CVE-2015-9295",
"lastModified": "2024-11-21T02:40:16.660",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-08-13T17:15:11.767",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-08-13 17:15
Modified
2024-11-21 02:01
Severity ?
Summary
The contact-form-plugin plugin before 3.52 for WordPress has XSS.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://wordpress.org/plugins/contact-form-plugin/#developers | Release Notes, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://wordpress.org/plugins/contact-form-plugin/#developers | Release Notes, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bestwebsoft | contact_form | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bestwebsoft:contact_form:*:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "E1FEE366-5A53-4F35-8C00-357965A982FC",
"versionEndExcluding": "3.52",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The contact-form-plugin plugin before 3.52 for WordPress has XSS."
},
{
"lang": "es",
"value": "El complemento contact-form-plugin antes de 3.52 para WordPress tiene XSS."
}
],
"id": "CVE-2013-7475",
"lastModified": "2024-11-21T02:01:06.017",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-08-13T17:15:11.547",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-04-09 06:15
Modified
2024-11-21 01:36
Severity ?
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
A vulnerability was found in BestWebSoft Contact Form 3.21. It has been classified as problematic. This affects the function cntctfrm_settings_page of the file contact_form.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 3.22 is able to address this issue. The identifier of the patch is 8398d96ff0fe45ec9267d7259961c2ef89ed8005. It is recommended to upgrade the affected component. The identifier VDB-225321 was assigned to this vulnerability.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cna@vuldb.com | https://github.com/wp-plugins/contact-form-plugin/commit/8398d96ff0fe45ec9267d7259961c2ef89ed8005 | Patch | |
| cna@vuldb.com | https://vuldb.com/?ctiid.225321 | Permissions Required, Third Party Advisory | |
| cna@vuldb.com | https://vuldb.com/?id.225321 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/wp-plugins/contact-form-plugin/commit/8398d96ff0fe45ec9267d7259961c2ef89ed8005 | Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | https://vuldb.com/?ctiid.225321 | Permissions Required, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://vuldb.com/?id.225321 | Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| bestwebsoft | contact_form | 3.21 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bestwebsoft:contact_form:3.21:*:*:*:*:wordpress:*:*",
"matchCriteriaId": "E5F55DA8-2A71-462C-89B4-82A404DDD8CE",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in BestWebSoft Contact Form 3.21. It has been classified as problematic. This affects the function cntctfrm_settings_page of the file contact_form.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 3.22 is able to address this issue. The identifier of the patch is 8398d96ff0fe45ec9267d7259961c2ef89ed8005. It is recommended to upgrade the affected component. The identifier VDB-225321 was assigned to this vulnerability."
}
],
"id": "CVE-2012-10010",
"lastModified": "2024-11-21T01:36:08.787",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "cna@vuldb.com",
"type": "Secondary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "cna@vuldb.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-04-09T06:15:10.303",
"references": [
{
"source": "cna@vuldb.com",
"tags": [
"Patch"
],
"url": "https://github.com/wp-plugins/contact-form-plugin/commit/8398d96ff0fe45ec9267d7259961c2ef89ed8005"
},
{
"source": "cna@vuldb.com",
"tags": [
"Permissions Required",
"Third Party Advisory"
],
"url": "https://vuldb.com/?ctiid.225321"
},
{
"source": "cna@vuldb.com",
"tags": [
"Third Party Advisory"
],
"url": "https://vuldb.com/?id.225321"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://github.com/wp-plugins/contact-form-plugin/commit/8398d96ff0fe45ec9267d7259961c2ef89ed8005"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Permissions Required",
"Third Party Advisory"
],
"url": "https://vuldb.com/?ctiid.225321"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://vuldb.com/?id.225321"
}
],
"sourceIdentifier": "cna@vuldb.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-352"
}
],
"source": "cna@vuldb.com",
"type": "Primary"
}
]
}