Search criteria
22 vulnerabilities found for contact_form by bestwebsoft
CVE-2024-2200 (GCVE-0-2024-2200)
Vulnerability from nvd – Published: 2024-04-09 18:58 – Updated: 2025-08-27 21:02
VLAI?
Summary
The Contact Form by BestWebSoft plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘cntctfrm_contact_subject’ parameter in all versions up to, and including, 4.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Severity ?
6.1 (Medium)
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| bestwebsoft | Contact Form by BestWebSoft – Advanced Contact Us Form Builder for WordPress |
Affected:
* , ≤ 4.2.8
(semver)
|
Credits
Krzysztof Zając
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-2200",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-11T15:54:28.122300Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-27T21:02:56.904Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T19:03:39.383Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/28524702-3428-4fca-afe8-71b3f2dd983d?source=cve"
},
{
"tags": [
"x_transferred"
],
"url": "https://plugins.trac.wordpress.org/changeset/3047840/contact-form-plugin"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Contact Form by BestWebSoft \u2013 Advanced Contact Us Form Builder for WordPress",
"vendor": "bestwebsoft",
"versions": [
{
"lessThanOrEqual": "4.2.8",
"status": "affected",
"version": "*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Krzysztof Zaj\u0105c"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Contact Form by BestWebSoft plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u2018cntctfrm_contact_subject\u2019 parameter in all versions up to, and including, 4.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-09T18:58:39.126Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/28524702-3428-4fca-afe8-71b3f2dd983d?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3047840/contact-form-plugin"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-03-05T00:00:00.000+00:00",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2024-03-13T00:00:00.000+00:00",
"value": "Disclosed"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2024-2200",
"datePublished": "2024-04-09T18:58:39.126Z",
"dateReserved": "2024-03-05T19:09:41.491Z",
"dateUpdated": "2025-08-27T21:02:56.904Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-125095 (GCVE-0-2014-125095)
Vulnerability from nvd – Published: 2023-04-09 05:31 – Updated: 2024-08-06 14:10
VLAI?
Title
BestWebSoft Contact Form Plugin bws_menu.php bws_add_menu_render cross site scripting
Summary
A vulnerability was found in BestWebSoft Contact Form Plugin 1.3.4 on WordPress and classified as problematic. Affected by this issue is the function bws_add_menu_render of the file bws_menu/bws_menu.php. The manipulation of the argument bwsmn_form_email leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.3.7 is able to address this issue. The name of the patch is 4d531f74b4a801c805dc80360d4ea1312e9a278f. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-225320.
Severity ?
CWE
- CWE-79 - Cross Site Scripting
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| BestWebSoft | Contact Form Plugin |
Affected:
1.3.4
|
Credits
VulDB GitHub Commit Analyzer
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T14:10:56.681Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vdb-entry",
"technical-description",
"x_transferred"
],
"url": "https://vuldb.com/?id.225320"
},
{
"tags": [
"signature",
"permissions-required",
"x_transferred"
],
"url": "https://vuldb.com/?ctiid.225320"
},
{
"tags": [
"patch",
"x_transferred"
],
"url": "https://github.com/wp-plugins/contact-form-plugin/commit/4d531f74b4a801c805dc80360d4ea1312e9a278f"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Contact Form Plugin",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "1.3.4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "tool",
"value": "VulDB GitHub Commit Analyzer"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in BestWebSoft Contact Form Plugin 1.3.4 on WordPress and classified as problematic. Affected by this issue is the function bws_add_menu_render of the file bws_menu/bws_menu.php. The manipulation of the argument bwsmn_form_email leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.3.7 is able to address this issue. The name of the patch is 4d531f74b4a801c805dc80360d4ea1312e9a278f. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-225320."
},
{
"lang": "de",
"value": "Eine Schwachstelle wurde in BestWebSoft Contact Form Plugin 1.3.4 f\u00fcr WordPress gefunden. Sie wurde als problematisch eingestuft. Davon betroffen ist die Funktion bws_add_menu_render der Datei bws_menu/bws_menu.php. Durch das Manipulieren des Arguments bwsmn_form_email mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk erfolgen. Ein Aktualisieren auf die Version 1.3.7 vermag dieses Problem zu l\u00f6sen. Der Patch wird als 4d531f74b4a801c805dc80360d4ea1312e9a278f bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-20T07:12:42.020Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.225320"
},
{
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.225320"
},
{
"tags": [
"patch"
],
"url": "https://github.com/wp-plugins/contact-form-plugin/commit/4d531f74b4a801c805dc80360d4ea1312e9a278f"
}
],
"timeline": [
{
"lang": "en",
"time": "2023-04-07T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2023-04-07T00:00:00.000Z",
"value": "CVE reserved"
},
{
"lang": "en",
"time": "2023-04-07T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2023-04-26T07:49:29.000Z",
"value": "VulDB entry last update"
}
],
"title": "BestWebSoft Contact Form Plugin bws_menu.php bws_add_menu_render cross site scripting"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2014-125095",
"datePublished": "2023-04-09T05:31:04.461Z",
"dateReserved": "2023-04-07T16:43:16.681Z",
"dateUpdated": "2024-08-06T14:10:56.681Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-10010 (GCVE-0-2012-10010)
Vulnerability from nvd – Published: 2023-04-09 05:31 – Updated: 2024-08-06 21:36
VLAI?
Title
BestWebSoft Contact Form contact_form.php cntctfrm_settings_page cross-site request forgery
Summary
A vulnerability was found in BestWebSoft Contact Form 3.21. It has been classified as problematic. This affects the function cntctfrm_settings_page of the file contact_form.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 3.22 is able to address this issue. The identifier of the patch is 8398d96ff0fe45ec9267d7259961c2ef89ed8005. It is recommended to upgrade the affected component. The identifier VDB-225321 was assigned to this vulnerability.
Severity ?
4.3 (Medium)
4.3 (Medium)
CWE
- CWE-352 - Cross-Site Request Forgery
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| BestWebSoft | Contact Form |
Affected:
3.21
|
Credits
VulDB GitHub Commit Analyzer
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T21:36:02.040Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vdb-entry",
"technical-description",
"x_transferred"
],
"url": "https://vuldb.com/?id.225321"
},
{
"tags": [
"signature",
"permissions-required",
"x_transferred"
],
"url": "https://vuldb.com/?ctiid.225321"
},
{
"tags": [
"patch",
"x_transferred"
],
"url": "https://github.com/wp-plugins/contact-form-plugin/commit/8398d96ff0fe45ec9267d7259961c2ef89ed8005"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Contact Form",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "3.21"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "tool",
"value": "VulDB GitHub Commit Analyzer"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in BestWebSoft Contact Form 3.21. It has been classified as problematic. This affects the function cntctfrm_settings_page of the file contact_form.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 3.22 is able to address this issue. The identifier of the patch is 8398d96ff0fe45ec9267d7259961c2ef89ed8005. It is recommended to upgrade the affected component. The identifier VDB-225321 was assigned to this vulnerability."
},
{
"lang": "de",
"value": "Es wurde eine Schwachstelle in BestWebSoft Contact Form 3.21 ausgemacht. Sie wurde als problematisch eingestuft. Hiervon betroffen ist die Funktion cntctfrm_settings_page der Datei contact_form.php. Durch Manipulieren mit unbekannten Daten kann eine cross-site request forgery-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Ein Aktualisieren auf die Version 3.22 vermag dieses Problem zu l\u00f6sen. Der Patch wird als 8398d96ff0fe45ec9267d7259961c2ef89ed8005 bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-12T08:42:46.005Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.225321"
},
{
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.225321"
},
{
"tags": [
"patch"
],
"url": "https://github.com/wp-plugins/contact-form-plugin/commit/8398d96ff0fe45ec9267d7259961c2ef89ed8005"
}
],
"timeline": [
{
"lang": "en",
"time": "2023-04-07T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2023-04-07T00:00:00.000Z",
"value": "CVE reserved"
},
{
"lang": "en",
"time": "2023-04-07T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2023-04-26T08:01:08.000Z",
"value": "VulDB last update"
}
],
"title": "BestWebSoft Contact Form contact_form.php cntctfrm_settings_page cross-site request forgery"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2012-10010",
"datePublished": "2023-04-09T05:31:03.479Z",
"dateReserved": "2023-04-07T16:44:56.778Z",
"dateUpdated": "2024-08-06T21:36:02.040Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-10022 (GCVE-0-2013-10022)
Vulnerability from nvd – Published: 2023-04-05 12:31 – Updated: 2024-08-06 18:09
VLAI?
Title
BestWebSoft Contact Form Plugin contact_form.php cntctfrm_check_form cross site scripting
Summary
A vulnerability, which was classified as problematic, has been found in BestWebSoft Contact Form Plugin 3.51 on WordPress. Affected by this issue is the function cntctfrm_display_form/cntctfrm_check_form of the file contact_form.php. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 3.52 is able to address this issue. The patch is identified as 642ef1dc1751ab6642ce981fe126325bb574f898. It is recommended to upgrade the affected component. VDB-225002 is the identifier assigned to this vulnerability.
Severity ?
CWE
- CWE-79 - Cross Site Scripting
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| BestWebSoft | Contact Form Plugin |
Affected:
3.51
|
Credits
VulDB GitHub Commit Analyzer
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T18:09:17.085Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vdb-entry",
"technical-description",
"x_transferred"
],
"url": "https://vuldb.com/?id.225002"
},
{
"tags": [
"signature",
"permissions-required",
"x_transferred"
],
"url": "https://vuldb.com/?ctiid.225002"
},
{
"tags": [
"patch",
"x_transferred"
],
"url": "https://github.com/wp-plugins/contact-form-plugin/commit/642ef1dc1751ab6642ce981fe126325bb574f898"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Contact Form Plugin",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "3.51"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "tool",
"value": "VulDB GitHub Commit Analyzer"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability, which was classified as problematic, has been found in BestWebSoft Contact Form Plugin 3.51 on WordPress. Affected by this issue is the function cntctfrm_display_form/cntctfrm_check_form of the file contact_form.php. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 3.52 is able to address this issue. The patch is identified as 642ef1dc1751ab6642ce981fe126325bb574f898. It is recommended to upgrade the affected component. VDB-225002 is the identifier assigned to this vulnerability."
},
{
"lang": "de",
"value": "Eine problematische Schwachstelle wurde in BestWebSoft Contact Form Plugin 3.51 f\u00fcr WordPress entdeckt. Dies betrifft die Funktion cntctfrm_display_form/cntctfrm_check_form der Datei contact_form.php. Durch Manipulieren mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Ein Aktualisieren auf die Version 3.52 vermag dieses Problem zu l\u00f6sen. Der Patch wird als 642ef1dc1751ab6642ce981fe126325bb574f898 bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-20T05:38:48.844Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.225002"
},
{
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.225002"
},
{
"tags": [
"patch"
],
"url": "https://github.com/wp-plugins/contact-form-plugin/commit/642ef1dc1751ab6642ce981fe126325bb574f898"
}
],
"timeline": [
{
"lang": "en",
"time": "2023-03-22T00:00:00.000Z",
"value": "CVE reserved"
},
{
"lang": "en",
"time": "2023-04-05T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2023-04-05T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2023-04-22T17:11:34.000Z",
"value": "VulDB entry last update"
}
],
"title": "BestWebSoft Contact Form Plugin contact_form.php cntctfrm_check_form cross site scripting"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2013-10022",
"datePublished": "2023-04-05T12:31:03.375Z",
"dateReserved": "2023-03-22T11:08:35.385Z",
"dateUpdated": "2024-08-06T18:09:17.085Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-20055 (GCVE-0-2017-20055)
Vulnerability from nvd – Published: 2022-06-16 12:20 – Updated: 2025-04-15 14:24
VLAI?
Title
BestWebSoft Contact Form Plugin Stored cross site scriting
Summary
A vulnerability classified as problematic has been found in BestWebSoft Contact Form Plugin 4.0.0. This affects an unknown part. The manipulation leads to basic cross site scripting (Stored). It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.0.2 is able to address this issue. It is recommended to upgrade the affected component.
Severity ?
CWE
- CWE-80 - Basic Cross Site Scripting
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| BestWebSoft | Contact Form Plugin |
Affected:
4.0.0
|
Credits
Julien Rentrop
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T21:45:25.194Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2017/Feb/100"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://sumofpwn.nl/advisory/2016/stored_cross_site_scripting_vulnerability_in_contact_form_wordpress_plugin.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://vuldb.com/?id.97389"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2017-20055",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-14T17:11:02.807428Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-15T14:24:31.117Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Contact Form Plugin",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "4.0.0"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Julien Rentrop"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability classified as problematic has been found in BestWebSoft Contact Form Plugin 4.0.0. This affects an unknown part. The manipulation leads to basic cross site scripting (Stored). It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.0.2 is able to address this issue. It is recommended to upgrade the affected component."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-80",
"description": "CWE-80 Basic Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-16T12:20:22.000Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://seclists.org/fulldisclosure/2017/Feb/100"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://sumofpwn.nl/advisory/2016/stored_cross_site_scripting_vulnerability_in_contact_form_wordpress_plugin.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://vuldb.com/?id.97389"
}
],
"title": "BestWebSoft Contact Form Plugin Stored cross site scriting",
"x_generator": "vuldb.com",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cna@vuldb.com",
"ID": "CVE-2017-20055",
"REQUESTER": "cna@vuldb.com",
"STATE": "PUBLIC",
"TITLE": "BestWebSoft Contact Form Plugin Stored cross site scriting"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Contact Form Plugin",
"version": {
"version_data": [
{
"version_value": "4.0.0"
}
]
}
}
]
},
"vendor_name": "BestWebSoft"
}
]
}
},
"credit": "Julien Rentrop",
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability classified as problematic has been found in BestWebSoft Contact Form Plugin 4.0.0. This affects an unknown part. The manipulation leads to basic cross site scripting (Stored). It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.0.2 is able to address this issue. It is recommended to upgrade the affected component."
}
]
},
"generator": "vuldb.com",
"impact": {
"cvss": {
"baseScore": "3.5",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-80 Basic Cross Site Scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://seclists.org/fulldisclosure/2017/Feb/100",
"refsource": "MISC",
"url": "http://seclists.org/fulldisclosure/2017/Feb/100"
},
{
"name": "https://sumofpwn.nl/advisory/2016/stored_cross_site_scripting_vulnerability_in_contact_form_wordpress_plugin.html",
"refsource": "MISC",
"url": "https://sumofpwn.nl/advisory/2016/stored_cross_site_scripting_vulnerability_in_contact_form_wordpress_plugin.html"
},
{
"name": "https://vuldb.com/?id.97389",
"refsource": "MISC",
"url": "https://vuldb.com/?id.97389"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2017-20055",
"datePublished": "2022-06-16T12:20:22.000Z",
"dateReserved": "2022-06-13T00:00:00.000Z",
"dateUpdated": "2025-04-15T14:24:31.117Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-7481 (GCVE-0-2013-7481)
Vulnerability from nvd – Published: 2019-08-22 12:46 – Updated: 2024-08-06 18:09
VLAI?
Summary
The contact-form-plugin plugin before 3.3.5 for WordPress has XSS.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T18:09:17.142Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The contact-form-plugin plugin before 3.3.5 for WordPress has XSS."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-08-22T12:46:07",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-7481",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The contact-form-plugin plugin before 3.3.5 for WordPress has XSS."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wordpress.org/plugins/contact-form-plugin/#developers",
"refsource": "MISC",
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-7481",
"datePublished": "2019-08-22T12:46:07",
"dateReserved": "2019-08-21T00:00:00",
"dateUpdated": "2024-08-06T18:09:17.142Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-18491 (GCVE-0-2017-18491)
Vulnerability from nvd – Published: 2019-08-13 16:49 – Updated: 2024-08-05 21:20
VLAI?
Summary
The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T21:20:51.316Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-08-13T16:49:40",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-18491",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wordpress.org/plugins/contact-form-plugin/#developers",
"refsource": "MISC",
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-18491",
"datePublished": "2019-08-13T16:49:40",
"dateReserved": "2019-08-12T00:00:00",
"dateUpdated": "2024-08-05T21:20:51.316Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2016-10869 (GCVE-0-2016-10869)
Vulnerability from nvd – Published: 2019-08-13 16:48 – Updated: 2024-08-06 03:38
VLAI?
Summary
The contact-form-plugin plugin before 4.0.2 for WordPress has XSS.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T03:38:56.737Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The contact-form-plugin plugin before 4.0.2 for WordPress has XSS."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-08-13T16:48:52",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-10869",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The contact-form-plugin plugin before 4.0.2 for WordPress has XSS."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wordpress.org/plugins/contact-form-plugin/#developers",
"refsource": "MISC",
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-10869",
"datePublished": "2019-08-13T16:48:52",
"dateReserved": "2019-08-12T00:00:00",
"dateUpdated": "2024-08-06T03:38:56.737Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-9295 (GCVE-0-2015-9295)
Vulnerability from nvd – Published: 2019-08-13 16:48 – Updated: 2024-08-06 08:43
VLAI?
Summary
The contact-form-plugin plugin before 3.96 for WordPress has XSS.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T08:43:42.565Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The contact-form-plugin plugin before 3.96 for WordPress has XSS."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-08-13T16:48:27",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-9295",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The contact-form-plugin plugin before 3.96 for WordPress has XSS."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wordpress.org/plugins/contact-form-plugin/#developers",
"refsource": "MISC",
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-9295",
"datePublished": "2019-08-13T16:48:27",
"dateReserved": "2019-08-12T00:00:00",
"dateUpdated": "2024-08-06T08:43:42.565Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-7475 (GCVE-0-2013-7475)
Vulnerability from nvd – Published: 2019-08-13 16:47 – Updated: 2024-08-06 18:09
VLAI?
Summary
The contact-form-plugin plugin before 3.52 for WordPress has XSS.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T18:09:16.901Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The contact-form-plugin plugin before 3.52 for WordPress has XSS."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-08-13T16:47:59",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-7475",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The contact-form-plugin plugin before 3.52 for WordPress has XSS."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wordpress.org/plugins/contact-form-plugin/#developers",
"refsource": "MISC",
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-7475",
"datePublished": "2019-08-13T16:47:59",
"dateReserved": "2019-08-12T00:00:00",
"dateUpdated": "2024-08-06T18:09:16.901Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-2171 (GCVE-0-2017-2171)
Vulnerability from nvd – Published: 2017-05-22 16:00 – Updated: 2024-08-05 13:48
VLAI?
Summary
Cross-site scripting vulnerability in Captcha prior to version 4.3.0, Car Rental prior to version 1.0.5, Contact Form Multi prior to version 1.2.1, Contact Form prior to version 4.0.6, Contact Form to DB prior to version 1.5.7, Custom Admin Page prior to version 0.1.2, Custom Fields Search prior to version 1.3.2, Custom Search prior to version 1.36, Donate prior to version 2.1.1, Email Queue prior to version 1.1.2, Error Log Viewer prior to version 1.0.6, Facebook Button prior to version 2.54, Featured Posts prior to version 1.0.1, Gallery Categories prior to version 1.0.9, Gallery prior to version 4.5.0, Google +1 prior to version 1.3.4, Google AdSense prior to version 1.44, Google Analytics prior to version 1.7.1, Google Captcha (reCAPTCHA) prior to version 1.28, Google Maps prior to version 1.3.6, Google Shortlink prior to version 1.5.3, Google Sitemap prior to version 3.0.8, Htaccess prior to version 1.7.6, Job Board prior to version 1.1.3, Latest Posts prior to version 0.3, Limit Attempts prior to version 1.1.8, LinkedIn prior to version 1.0.5, Multilanguage prior to version 1.2.2, PDF & Print prior to version 1.9.4, Pagination prior to version 1.0.7, Pinterest prior to version 1.0.5, Popular Posts prior to version 1.0.5, Portfolio prior to version 2.4, Post to CSV prior to version 1.3.1, Profile Extra prior to version 1.0.7. PromoBar prior to version 1.1.1, Quotes and Tips prior to version 1.32, Re-attacher prior to version 1.0.9, Realty prior to version 1.1.0, Relevant - Related Posts prior to version 1.2.0, Sender prior to version 1.2.1, SMTP prior to version 1.1.0, Social Buttons Pack prior to version 1.1.1, Subscriber prior to version 1.3.5, Testimonials prior to version 0.1.9, Timesheet prior to version 0.1.5, Twitter Button prior to version 2.55, User Role prior to version 1.5.6, Updater prior to version 1.35, Visitors Online prior to version 1.0.0, and Zendesk Help Center prior to version 1.0.5 allows remote attackers to inject arbitrary web script or HTML via the function to display the BestWebSoft menu.
Severity ?
No CVSS data available.
CWE
- Cross-site scripting
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| BestWebSoft | Captcha |
Affected:
prior to version 4.3.0
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T13:48:03.789Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "JVNDB-2017-000094",
"tags": [
"third-party-advisory",
"x_refsource_JVNDB",
"x_transferred"
],
"url": "http://jvndb.jvn.jp/jvndb/JVNDB-2017-000094"
},
{
"name": "JVN#24834813",
"tags": [
"third-party-advisory",
"x_refsource_JVN",
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN24834813/index.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Captcha",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 4.3.0"
}
]
},
{
"product": "Car Rental",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.0.5"
}
]
},
{
"product": "Contact Form Multi",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.2.1"
}
]
},
{
"product": "Contact Form",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 4.0.6"
}
]
},
{
"product": "Contact Form to DB",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.5.7"
}
]
},
{
"product": "Custom Admin Page",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 0.1.2"
}
]
},
{
"product": "Custom Fields Search",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.3.2"
}
]
},
{
"product": "Custom Search",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.36"
}
]
},
{
"product": "Donate",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 2.1.1"
}
]
},
{
"product": "Email Queue",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.1.2"
}
]
},
{
"product": "Error Log Viewer",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.0.6"
}
]
},
{
"product": "Facebook Button",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 2.54"
}
]
},
{
"product": "Featured Posts",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.0.1"
}
]
},
{
"product": "Gallery Categories",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.0.9"
}
]
},
{
"product": "Gallery",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 4.5.0"
}
]
},
{
"product": "Google +1",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.3.4"
}
]
},
{
"product": "Google AdSense",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.44"
}
]
},
{
"product": "Google Analytics",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.7.1"
}
]
},
{
"product": "Google Captcha (reCAPTCHA)",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.28"
}
]
},
{
"product": "Google Maps",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.3.6"
}
]
},
{
"product": "Google Shortlink",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.5.3"
}
]
},
{
"product": "Google Sitemap",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 3.0.8"
}
]
},
{
"product": "Htaccess",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.7.6"
}
]
},
{
"product": "Job Board",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.1.3"
}
]
},
{
"product": "Latest Posts",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 0.3"
}
]
},
{
"product": "Limit Attempts",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.1.8"
}
]
},
{
"product": "LinkedIn",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.0.5"
}
]
},
{
"product": "Multilanguage",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.2.2"
}
]
},
{
"product": "PDF \u0026 Print",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.9.4"
}
]
},
{
"product": "Pagination",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.0.7"
}
]
},
{
"product": "Pinterest",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.0.5"
}
]
},
{
"product": "Popular Posts",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.0.5"
}
]
},
{
"product": "Portfolio",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 2.4"
}
]
},
{
"product": "Post to CSV",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.3.1"
}
]
},
{
"product": "Profile Extra",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.0.7"
}
]
},
{
"product": "PromoBar",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.1.1"
}
]
},
{
"product": "Quotes and Tips",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.32"
}
]
},
{
"product": "Re-attacher",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.0.9"
}
]
},
{
"product": "Realty",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.1.0"
}
]
},
{
"product": "Relevant - Related Posts",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.2.0"
}
]
},
{
"product": "Sender",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.2.1"
}
]
},
{
"product": "SMTP",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.1.0"
}
]
},
{
"product": "Social Buttons Pack",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.1.1"
}
]
},
{
"product": "Subscriber",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.3.5"
}
]
},
{
"product": "Testimonials",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 0.1.9"
}
]
},
{
"product": "Timesheet",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 0.1.5"
}
]
},
{
"product": "Twitter Button",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 2.55"
}
]
},
{
"product": "User Role",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.5.6"
}
]
},
{
"product": "Updater",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.35"
}
]
},
{
"product": "Visitors Online",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.0.0"
}
]
},
{
"product": "Zendesk Help Center",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.0.5"
}
]
}
],
"datePublic": "2017-05-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting vulnerability in Captcha prior to version 4.3.0, Car Rental prior to version 1.0.5, Contact Form Multi prior to version 1.2.1, Contact Form prior to version 4.0.6, Contact Form to DB prior to version 1.5.7, Custom Admin Page prior to version 0.1.2, Custom Fields Search prior to version 1.3.2, Custom Search prior to version 1.36, Donate prior to version 2.1.1, Email Queue prior to version 1.1.2, Error Log Viewer prior to version 1.0.6, Facebook Button prior to version 2.54, Featured Posts prior to version 1.0.1, Gallery Categories prior to version 1.0.9, Gallery prior to version 4.5.0, Google +1 prior to version 1.3.4, Google AdSense prior to version 1.44, Google Analytics prior to version 1.7.1, Google Captcha (reCAPTCHA) prior to version 1.28, Google Maps prior to version 1.3.6, Google Shortlink prior to version 1.5.3, Google Sitemap prior to version 3.0.8, Htaccess prior to version 1.7.6, Job Board prior to version 1.1.3, Latest Posts prior to version 0.3, Limit Attempts prior to version 1.1.8, LinkedIn prior to version 1.0.5, Multilanguage prior to version 1.2.2, PDF \u0026 Print prior to version 1.9.4, Pagination prior to version 1.0.7, Pinterest prior to version 1.0.5, Popular Posts prior to version 1.0.5, Portfolio prior to version 2.4, Post to CSV prior to version 1.3.1, Profile Extra prior to version 1.0.7. PromoBar prior to version 1.1.1, Quotes and Tips prior to version 1.32, Re-attacher prior to version 1.0.9, Realty prior to version 1.1.0, Relevant - Related Posts prior to version 1.2.0, Sender prior to version 1.2.1, SMTP prior to version 1.1.0, Social Buttons Pack prior to version 1.1.1, Subscriber prior to version 1.3.5, Testimonials prior to version 0.1.9, Timesheet prior to version 0.1.5, Twitter Button prior to version 2.55, User Role prior to version 1.5.6, Updater prior to version 1.35, Visitors Online prior to version 1.0.0, and Zendesk Help Center prior to version 1.0.5 allows remote attackers to inject arbitrary web script or HTML via the function to display the BestWebSoft menu."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-site scripting",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-05-22T15:57:01",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"name": "JVNDB-2017-000094",
"tags": [
"third-party-advisory",
"x_refsource_JVNDB"
],
"url": "http://jvndb.jvn.jp/jvndb/JVNDB-2017-000094"
},
{
"name": "JVN#24834813",
"tags": [
"third-party-advisory",
"x_refsource_JVN"
],
"url": "https://jvn.jp/en/jp/JVN24834813/index.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "vultures@jpcert.or.jp",
"ID": "CVE-2017-2171",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Captcha",
"version": {
"version_data": [
{
"version_value": "prior to version 4.3.0"
}
]
}
},
{
"product_name": "Car Rental",
"version": {
"version_data": [
{
"version_value": "prior to version 1.0.5"
}
]
}
},
{
"product_name": "Contact Form Multi",
"version": {
"version_data": [
{
"version_value": "prior to version 1.2.1"
}
]
}
},
{
"product_name": "Contact Form",
"version": {
"version_data": [
{
"version_value": "prior to version 4.0.6"
}
]
}
},
{
"product_name": "Contact Form to DB",
"version": {
"version_data": [
{
"version_value": "prior to version 1.5.7"
}
]
}
},
{
"product_name": "Custom Admin Page",
"version": {
"version_data": [
{
"version_value": "prior to version 0.1.2"
}
]
}
},
{
"product_name": "Custom Fields Search",
"version": {
"version_data": [
{
"version_value": "prior to version 1.3.2"
}
]
}
},
{
"product_name": "Custom Search",
"version": {
"version_data": [
{
"version_value": "prior to version 1.36"
}
]
}
},
{
"product_name": "Donate",
"version": {
"version_data": [
{
"version_value": "prior to version 2.1.1"
}
]
}
},
{
"product_name": "Email Queue",
"version": {
"version_data": [
{
"version_value": "prior to version 1.1.2"
}
]
}
},
{
"product_name": "Error Log Viewer",
"version": {
"version_data": [
{
"version_value": "prior to version 1.0.6"
}
]
}
},
{
"product_name": "Facebook Button",
"version": {
"version_data": [
{
"version_value": "prior to version 2.54"
}
]
}
},
{
"product_name": "Featured Posts",
"version": {
"version_data": [
{
"version_value": "prior to version 1.0.1"
}
]
}
},
{
"product_name": "Gallery Categories",
"version": {
"version_data": [
{
"version_value": "prior to version 1.0.9"
}
]
}
},
{
"product_name": "Gallery",
"version": {
"version_data": [
{
"version_value": "prior to version 4.5.0"
}
]
}
},
{
"product_name": "Google +1",
"version": {
"version_data": [
{
"version_value": "prior to version 1.3.4"
}
]
}
},
{
"product_name": "Google AdSense",
"version": {
"version_data": [
{
"version_value": "prior to version 1.44"
}
]
}
},
{
"product_name": "Google Analytics",
"version": {
"version_data": [
{
"version_value": "prior to version 1.7.1"
}
]
}
},
{
"product_name": "Google Captcha (reCAPTCHA)",
"version": {
"version_data": [
{
"version_value": "prior to version 1.28"
}
]
}
},
{
"product_name": "Google Maps",
"version": {
"version_data": [
{
"version_value": "prior to version 1.3.6"
}
]
}
},
{
"product_name": "Google Shortlink",
"version": {
"version_data": [
{
"version_value": "prior to version 1.5.3"
}
]
}
},
{
"product_name": "Google Sitemap",
"version": {
"version_data": [
{
"version_value": "prior to version 3.0.8"
}
]
}
},
{
"product_name": "Htaccess",
"version": {
"version_data": [
{
"version_value": "prior to version 1.7.6"
}
]
}
},
{
"product_name": "Job Board",
"version": {
"version_data": [
{
"version_value": "prior to version 1.1.3"
}
]
}
},
{
"product_name": "Latest Posts",
"version": {
"version_data": [
{
"version_value": "prior to version 0.3"
}
]
}
},
{
"product_name": "Limit Attempts",
"version": {
"version_data": [
{
"version_value": "prior to version 1.1.8"
}
]
}
},
{
"product_name": "LinkedIn",
"version": {
"version_data": [
{
"version_value": "prior to version 1.0.5"
}
]
}
},
{
"product_name": "Multilanguage",
"version": {
"version_data": [
{
"version_value": "prior to version 1.2.2"
}
]
}
},
{
"product_name": "PDF \u0026 Print",
"version": {
"version_data": [
{
"version_value": "prior to version 1.9.4"
}
]
}
},
{
"product_name": "Pagination",
"version": {
"version_data": [
{
"version_value": "prior to version 1.0.7"
}
]
}
},
{
"product_name": "Pinterest",
"version": {
"version_data": [
{
"version_value": "prior to version 1.0.5"
}
]
}
},
{
"product_name": "Popular Posts",
"version": {
"version_data": [
{
"version_value": "prior to version 1.0.5"
}
]
}
},
{
"product_name": "Portfolio",
"version": {
"version_data": [
{
"version_value": "prior to version 2.4"
}
]
}
},
{
"product_name": "Post to CSV",
"version": {
"version_data": [
{
"version_value": "prior to version 1.3.1"
}
]
}
},
{
"product_name": "Profile Extra",
"version": {
"version_data": [
{
"version_value": "prior to version 1.0.7"
}
]
}
},
{
"product_name": "PromoBar",
"version": {
"version_data": [
{
"version_value": "prior to version 1.1.1"
}
]
}
},
{
"product_name": "Quotes and Tips",
"version": {
"version_data": [
{
"version_value": "prior to version 1.32"
}
]
}
},
{
"product_name": "Re-attacher",
"version": {
"version_data": [
{
"version_value": "prior to version 1.0.9"
}
]
}
},
{
"product_name": "Realty",
"version": {
"version_data": [
{
"version_value": "prior to version 1.1.0"
}
]
}
},
{
"product_name": "Relevant - Related Posts",
"version": {
"version_data": [
{
"version_value": "prior to version 1.2.0"
}
]
}
},
{
"product_name": "Sender",
"version": {
"version_data": [
{
"version_value": "prior to version 1.2.1"
}
]
}
},
{
"product_name": "SMTP",
"version": {
"version_data": [
{
"version_value": "prior to version 1.1.0"
}
]
}
},
{
"product_name": "Social Buttons Pack",
"version": {
"version_data": [
{
"version_value": "prior to version 1.1.1"
}
]
}
},
{
"product_name": "Subscriber",
"version": {
"version_data": [
{
"version_value": "prior to version 1.3.5"
}
]
}
},
{
"product_name": "Testimonials",
"version": {
"version_data": [
{
"version_value": "prior to version 0.1.9"
}
]
}
},
{
"product_name": "Timesheet",
"version": {
"version_data": [
{
"version_value": "prior to version 0.1.5"
}
]
}
},
{
"product_name": "Twitter Button",
"version": {
"version_data": [
{
"version_value": "prior to version 2.55"
}
]
}
},
{
"product_name": "User Role",
"version": {
"version_data": [
{
"version_value": "prior to version 1.5.6"
}
]
}
},
{
"product_name": "Updater",
"version": {
"version_data": [
{
"version_value": "prior to version 1.35"
}
]
}
},
{
"product_name": "Visitors Online",
"version": {
"version_data": [
{
"version_value": "prior to version 1.0.0"
}
]
}
},
{
"product_name": "Zendesk Help Center",
"version": {
"version_data": [
{
"version_value": "prior to version 1.0.5"
}
]
}
}
]
},
"vendor_name": "BestWebSoft"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting vulnerability in Captcha prior to version 4.3.0, Car Rental prior to version 1.0.5, Contact Form Multi prior to version 1.2.1, Contact Form prior to version 4.0.6, Contact Form to DB prior to version 1.5.7, Custom Admin Page prior to version 0.1.2, Custom Fields Search prior to version 1.3.2, Custom Search prior to version 1.36, Donate prior to version 2.1.1, Email Queue prior to version 1.1.2, Error Log Viewer prior to version 1.0.6, Facebook Button prior to version 2.54, Featured Posts prior to version 1.0.1, Gallery Categories prior to version 1.0.9, Gallery prior to version 4.5.0, Google +1 prior to version 1.3.4, Google AdSense prior to version 1.44, Google Analytics prior to version 1.7.1, Google Captcha (reCAPTCHA) prior to version 1.28, Google Maps prior to version 1.3.6, Google Shortlink prior to version 1.5.3, Google Sitemap prior to version 3.0.8, Htaccess prior to version 1.7.6, Job Board prior to version 1.1.3, Latest Posts prior to version 0.3, Limit Attempts prior to version 1.1.8, LinkedIn prior to version 1.0.5, Multilanguage prior to version 1.2.2, PDF \u0026 Print prior to version 1.9.4, Pagination prior to version 1.0.7, Pinterest prior to version 1.0.5, Popular Posts prior to version 1.0.5, Portfolio prior to version 2.4, Post to CSV prior to version 1.3.1, Profile Extra prior to version 1.0.7. PromoBar prior to version 1.1.1, Quotes and Tips prior to version 1.32, Re-attacher prior to version 1.0.9, Realty prior to version 1.1.0, Relevant - Related Posts prior to version 1.2.0, Sender prior to version 1.2.1, SMTP prior to version 1.1.0, Social Buttons Pack prior to version 1.1.1, Subscriber prior to version 1.3.5, Testimonials prior to version 0.1.9, Timesheet prior to version 0.1.5, Twitter Button prior to version 2.55, User Role prior to version 1.5.6, Updater prior to version 1.35, Visitors Online prior to version 1.0.0, and Zendesk Help Center prior to version 1.0.5 allows remote attackers to inject arbitrary web script or HTML via the function to display the BestWebSoft menu."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Cross-site scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "JVNDB-2017-000094",
"refsource": "JVNDB",
"url": "http://jvndb.jvn.jp/jvndb/JVNDB-2017-000094"
},
{
"name": "JVN#24834813",
"refsource": "JVN",
"url": "https://jvn.jp/en/jp/JVN24834813/index.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2017-2171",
"datePublished": "2017-05-22T16:00:00",
"dateReserved": "2016-12-01T00:00:00",
"dateUpdated": "2024-08-05T13:48:03.789Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-2200 (GCVE-0-2024-2200)
Vulnerability from cvelistv5 – Published: 2024-04-09 18:58 – Updated: 2025-08-27 21:02
VLAI?
Summary
The Contact Form by BestWebSoft plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘cntctfrm_contact_subject’ parameter in all versions up to, and including, 4.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Severity ?
6.1 (Medium)
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| bestwebsoft | Contact Form by BestWebSoft – Advanced Contact Us Form Builder for WordPress |
Affected:
* , ≤ 4.2.8
(semver)
|
Credits
Krzysztof Zając
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-2200",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-11T15:54:28.122300Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-27T21:02:56.904Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T19:03:39.383Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/28524702-3428-4fca-afe8-71b3f2dd983d?source=cve"
},
{
"tags": [
"x_transferred"
],
"url": "https://plugins.trac.wordpress.org/changeset/3047840/contact-form-plugin"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Contact Form by BestWebSoft \u2013 Advanced Contact Us Form Builder for WordPress",
"vendor": "bestwebsoft",
"versions": [
{
"lessThanOrEqual": "4.2.8",
"status": "affected",
"version": "*",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Krzysztof Zaj\u0105c"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Contact Form by BestWebSoft plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the \u2018cntctfrm_contact_subject\u2019 parameter in all versions up to, and including, 4.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-09T18:58:39.126Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/28524702-3428-4fca-afe8-71b3f2dd983d?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3047840/contact-form-plugin"
}
],
"timeline": [
{
"lang": "en",
"time": "2024-03-05T00:00:00.000+00:00",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2024-03-13T00:00:00.000+00:00",
"value": "Disclosed"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2024-2200",
"datePublished": "2024-04-09T18:58:39.126Z",
"dateReserved": "2024-03-05T19:09:41.491Z",
"dateUpdated": "2025-08-27T21:02:56.904Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-125095 (GCVE-0-2014-125095)
Vulnerability from cvelistv5 – Published: 2023-04-09 05:31 – Updated: 2024-08-06 14:10
VLAI?
Title
BestWebSoft Contact Form Plugin bws_menu.php bws_add_menu_render cross site scripting
Summary
A vulnerability was found in BestWebSoft Contact Form Plugin 1.3.4 on WordPress and classified as problematic. Affected by this issue is the function bws_add_menu_render of the file bws_menu/bws_menu.php. The manipulation of the argument bwsmn_form_email leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.3.7 is able to address this issue. The name of the patch is 4d531f74b4a801c805dc80360d4ea1312e9a278f. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-225320.
Severity ?
CWE
- CWE-79 - Cross Site Scripting
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| BestWebSoft | Contact Form Plugin |
Affected:
1.3.4
|
Credits
VulDB GitHub Commit Analyzer
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T14:10:56.681Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vdb-entry",
"technical-description",
"x_transferred"
],
"url": "https://vuldb.com/?id.225320"
},
{
"tags": [
"signature",
"permissions-required",
"x_transferred"
],
"url": "https://vuldb.com/?ctiid.225320"
},
{
"tags": [
"patch",
"x_transferred"
],
"url": "https://github.com/wp-plugins/contact-form-plugin/commit/4d531f74b4a801c805dc80360d4ea1312e9a278f"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Contact Form Plugin",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "1.3.4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "tool",
"value": "VulDB GitHub Commit Analyzer"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in BestWebSoft Contact Form Plugin 1.3.4 on WordPress and classified as problematic. Affected by this issue is the function bws_add_menu_render of the file bws_menu/bws_menu.php. The manipulation of the argument bwsmn_form_email leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.3.7 is able to address this issue. The name of the patch is 4d531f74b4a801c805dc80360d4ea1312e9a278f. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-225320."
},
{
"lang": "de",
"value": "Eine Schwachstelle wurde in BestWebSoft Contact Form Plugin 1.3.4 f\u00fcr WordPress gefunden. Sie wurde als problematisch eingestuft. Davon betroffen ist die Funktion bws_add_menu_render der Datei bws_menu/bws_menu.php. Durch das Manipulieren des Arguments bwsmn_form_email mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk erfolgen. Ein Aktualisieren auf die Version 1.3.7 vermag dieses Problem zu l\u00f6sen. Der Patch wird als 4d531f74b4a801c805dc80360d4ea1312e9a278f bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-20T07:12:42.020Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.225320"
},
{
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.225320"
},
{
"tags": [
"patch"
],
"url": "https://github.com/wp-plugins/contact-form-plugin/commit/4d531f74b4a801c805dc80360d4ea1312e9a278f"
}
],
"timeline": [
{
"lang": "en",
"time": "2023-04-07T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2023-04-07T00:00:00.000Z",
"value": "CVE reserved"
},
{
"lang": "en",
"time": "2023-04-07T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2023-04-26T07:49:29.000Z",
"value": "VulDB entry last update"
}
],
"title": "BestWebSoft Contact Form Plugin bws_menu.php bws_add_menu_render cross site scripting"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2014-125095",
"datePublished": "2023-04-09T05:31:04.461Z",
"dateReserved": "2023-04-07T16:43:16.681Z",
"dateUpdated": "2024-08-06T14:10:56.681Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-10010 (GCVE-0-2012-10010)
Vulnerability from cvelistv5 – Published: 2023-04-09 05:31 – Updated: 2024-08-06 21:36
VLAI?
Title
BestWebSoft Contact Form contact_form.php cntctfrm_settings_page cross-site request forgery
Summary
A vulnerability was found in BestWebSoft Contact Form 3.21. It has been classified as problematic. This affects the function cntctfrm_settings_page of the file contact_form.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 3.22 is able to address this issue. The identifier of the patch is 8398d96ff0fe45ec9267d7259961c2ef89ed8005. It is recommended to upgrade the affected component. The identifier VDB-225321 was assigned to this vulnerability.
Severity ?
4.3 (Medium)
4.3 (Medium)
CWE
- CWE-352 - Cross-Site Request Forgery
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| BestWebSoft | Contact Form |
Affected:
3.21
|
Credits
VulDB GitHub Commit Analyzer
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T21:36:02.040Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vdb-entry",
"technical-description",
"x_transferred"
],
"url": "https://vuldb.com/?id.225321"
},
{
"tags": [
"signature",
"permissions-required",
"x_transferred"
],
"url": "https://vuldb.com/?ctiid.225321"
},
{
"tags": [
"patch",
"x_transferred"
],
"url": "https://github.com/wp-plugins/contact-form-plugin/commit/8398d96ff0fe45ec9267d7259961c2ef89ed8005"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Contact Form",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "3.21"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "tool",
"value": "VulDB GitHub Commit Analyzer"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in BestWebSoft Contact Form 3.21. It has been classified as problematic. This affects the function cntctfrm_settings_page of the file contact_form.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 3.22 is able to address this issue. The identifier of the patch is 8398d96ff0fe45ec9267d7259961c2ef89ed8005. It is recommended to upgrade the affected component. The identifier VDB-225321 was assigned to this vulnerability."
},
{
"lang": "de",
"value": "Es wurde eine Schwachstelle in BestWebSoft Contact Form 3.21 ausgemacht. Sie wurde als problematisch eingestuft. Hiervon betroffen ist die Funktion cntctfrm_settings_page der Datei contact_form.php. Durch Manipulieren mit unbekannten Daten kann eine cross-site request forgery-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Ein Aktualisieren auf die Version 3.22 vermag dieses Problem zu l\u00f6sen. Der Patch wird als 8398d96ff0fe45ec9267d7259961c2ef89ed8005 bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-12T08:42:46.005Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.225321"
},
{
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.225321"
},
{
"tags": [
"patch"
],
"url": "https://github.com/wp-plugins/contact-form-plugin/commit/8398d96ff0fe45ec9267d7259961c2ef89ed8005"
}
],
"timeline": [
{
"lang": "en",
"time": "2023-04-07T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2023-04-07T00:00:00.000Z",
"value": "CVE reserved"
},
{
"lang": "en",
"time": "2023-04-07T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2023-04-26T08:01:08.000Z",
"value": "VulDB last update"
}
],
"title": "BestWebSoft Contact Form contact_form.php cntctfrm_settings_page cross-site request forgery"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2012-10010",
"datePublished": "2023-04-09T05:31:03.479Z",
"dateReserved": "2023-04-07T16:44:56.778Z",
"dateUpdated": "2024-08-06T21:36:02.040Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-10022 (GCVE-0-2013-10022)
Vulnerability from cvelistv5 – Published: 2023-04-05 12:31 – Updated: 2024-08-06 18:09
VLAI?
Title
BestWebSoft Contact Form Plugin contact_form.php cntctfrm_check_form cross site scripting
Summary
A vulnerability, which was classified as problematic, has been found in BestWebSoft Contact Form Plugin 3.51 on WordPress. Affected by this issue is the function cntctfrm_display_form/cntctfrm_check_form of the file contact_form.php. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 3.52 is able to address this issue. The patch is identified as 642ef1dc1751ab6642ce981fe126325bb574f898. It is recommended to upgrade the affected component. VDB-225002 is the identifier assigned to this vulnerability.
Severity ?
CWE
- CWE-79 - Cross Site Scripting
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| BestWebSoft | Contact Form Plugin |
Affected:
3.51
|
Credits
VulDB GitHub Commit Analyzer
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T18:09:17.085Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vdb-entry",
"technical-description",
"x_transferred"
],
"url": "https://vuldb.com/?id.225002"
},
{
"tags": [
"signature",
"permissions-required",
"x_transferred"
],
"url": "https://vuldb.com/?ctiid.225002"
},
{
"tags": [
"patch",
"x_transferred"
],
"url": "https://github.com/wp-plugins/contact-form-plugin/commit/642ef1dc1751ab6642ce981fe126325bb574f898"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Contact Form Plugin",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "3.51"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "tool",
"value": "VulDB GitHub Commit Analyzer"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability, which was classified as problematic, has been found in BestWebSoft Contact Form Plugin 3.51 on WordPress. Affected by this issue is the function cntctfrm_display_form/cntctfrm_check_form of the file contact_form.php. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 3.52 is able to address this issue. The patch is identified as 642ef1dc1751ab6642ce981fe126325bb574f898. It is recommended to upgrade the affected component. VDB-225002 is the identifier assigned to this vulnerability."
},
{
"lang": "de",
"value": "Eine problematische Schwachstelle wurde in BestWebSoft Contact Form Plugin 3.51 f\u00fcr WordPress entdeckt. Dies betrifft die Funktion cntctfrm_display_form/cntctfrm_check_form der Datei contact_form.php. Durch Manipulieren mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren. Ein Aktualisieren auf die Version 3.52 vermag dieses Problem zu l\u00f6sen. Der Patch wird als 642ef1dc1751ab6642ce981fe126325bb574f898 bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-20T05:38:48.844Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.225002"
},
{
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.225002"
},
{
"tags": [
"patch"
],
"url": "https://github.com/wp-plugins/contact-form-plugin/commit/642ef1dc1751ab6642ce981fe126325bb574f898"
}
],
"timeline": [
{
"lang": "en",
"time": "2023-03-22T00:00:00.000Z",
"value": "CVE reserved"
},
{
"lang": "en",
"time": "2023-04-05T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2023-04-05T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2023-04-22T17:11:34.000Z",
"value": "VulDB entry last update"
}
],
"title": "BestWebSoft Contact Form Plugin contact_form.php cntctfrm_check_form cross site scripting"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2013-10022",
"datePublished": "2023-04-05T12:31:03.375Z",
"dateReserved": "2023-03-22T11:08:35.385Z",
"dateUpdated": "2024-08-06T18:09:17.085Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-20055 (GCVE-0-2017-20055)
Vulnerability from cvelistv5 – Published: 2022-06-16 12:20 – Updated: 2025-04-15 14:24
VLAI?
Title
BestWebSoft Contact Form Plugin Stored cross site scriting
Summary
A vulnerability classified as problematic has been found in BestWebSoft Contact Form Plugin 4.0.0. This affects an unknown part. The manipulation leads to basic cross site scripting (Stored). It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.0.2 is able to address this issue. It is recommended to upgrade the affected component.
Severity ?
CWE
- CWE-80 - Basic Cross Site Scripting
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| BestWebSoft | Contact Form Plugin |
Affected:
4.0.0
|
Credits
Julien Rentrop
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T21:45:25.194Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2017/Feb/100"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://sumofpwn.nl/advisory/2016/stored_cross_site_scripting_vulnerability_in_contact_form_wordpress_plugin.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://vuldb.com/?id.97389"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2017-20055",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-14T17:11:02.807428Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-15T14:24:31.117Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Contact Form Plugin",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "4.0.0"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Julien Rentrop"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability classified as problematic has been found in BestWebSoft Contact Form Plugin 4.0.0. This affects an unknown part. The manipulation leads to basic cross site scripting (Stored). It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.0.2 is able to address this issue. It is recommended to upgrade the affected component."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-80",
"description": "CWE-80 Basic Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-16T12:20:22.000Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://seclists.org/fulldisclosure/2017/Feb/100"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://sumofpwn.nl/advisory/2016/stored_cross_site_scripting_vulnerability_in_contact_form_wordpress_plugin.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://vuldb.com/?id.97389"
}
],
"title": "BestWebSoft Contact Form Plugin Stored cross site scriting",
"x_generator": "vuldb.com",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cna@vuldb.com",
"ID": "CVE-2017-20055",
"REQUESTER": "cna@vuldb.com",
"STATE": "PUBLIC",
"TITLE": "BestWebSoft Contact Form Plugin Stored cross site scriting"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Contact Form Plugin",
"version": {
"version_data": [
{
"version_value": "4.0.0"
}
]
}
}
]
},
"vendor_name": "BestWebSoft"
}
]
}
},
"credit": "Julien Rentrop",
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability classified as problematic has been found in BestWebSoft Contact Form Plugin 4.0.0. This affects an unknown part. The manipulation leads to basic cross site scripting (Stored). It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.0.2 is able to address this issue. It is recommended to upgrade the affected component."
}
]
},
"generator": "vuldb.com",
"impact": {
"cvss": {
"baseScore": "3.5",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-80 Basic Cross Site Scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://seclists.org/fulldisclosure/2017/Feb/100",
"refsource": "MISC",
"url": "http://seclists.org/fulldisclosure/2017/Feb/100"
},
{
"name": "https://sumofpwn.nl/advisory/2016/stored_cross_site_scripting_vulnerability_in_contact_form_wordpress_plugin.html",
"refsource": "MISC",
"url": "https://sumofpwn.nl/advisory/2016/stored_cross_site_scripting_vulnerability_in_contact_form_wordpress_plugin.html"
},
{
"name": "https://vuldb.com/?id.97389",
"refsource": "MISC",
"url": "https://vuldb.com/?id.97389"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2017-20055",
"datePublished": "2022-06-16T12:20:22.000Z",
"dateReserved": "2022-06-13T00:00:00.000Z",
"dateUpdated": "2025-04-15T14:24:31.117Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-7481 (GCVE-0-2013-7481)
Vulnerability from cvelistv5 – Published: 2019-08-22 12:46 – Updated: 2024-08-06 18:09
VLAI?
Summary
The contact-form-plugin plugin before 3.3.5 for WordPress has XSS.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T18:09:17.142Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The contact-form-plugin plugin before 3.3.5 for WordPress has XSS."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-08-22T12:46:07",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-7481",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The contact-form-plugin plugin before 3.3.5 for WordPress has XSS."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wordpress.org/plugins/contact-form-plugin/#developers",
"refsource": "MISC",
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-7481",
"datePublished": "2019-08-22T12:46:07",
"dateReserved": "2019-08-21T00:00:00",
"dateUpdated": "2024-08-06T18:09:17.142Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-18491 (GCVE-0-2017-18491)
Vulnerability from cvelistv5 – Published: 2019-08-13 16:49 – Updated: 2024-08-05 21:20
VLAI?
Summary
The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T21:20:51.316Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-08-13T16:49:40",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-18491",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wordpress.org/plugins/contact-form-plugin/#developers",
"refsource": "MISC",
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-18491",
"datePublished": "2019-08-13T16:49:40",
"dateReserved": "2019-08-12T00:00:00",
"dateUpdated": "2024-08-05T21:20:51.316Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2016-10869 (GCVE-0-2016-10869)
Vulnerability from cvelistv5 – Published: 2019-08-13 16:48 – Updated: 2024-08-06 03:38
VLAI?
Summary
The contact-form-plugin plugin before 4.0.2 for WordPress has XSS.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T03:38:56.737Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The contact-form-plugin plugin before 4.0.2 for WordPress has XSS."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-08-13T16:48:52",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2016-10869",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The contact-form-plugin plugin before 4.0.2 for WordPress has XSS."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wordpress.org/plugins/contact-form-plugin/#developers",
"refsource": "MISC",
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2016-10869",
"datePublished": "2019-08-13T16:48:52",
"dateReserved": "2019-08-12T00:00:00",
"dateUpdated": "2024-08-06T03:38:56.737Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-9295 (GCVE-0-2015-9295)
Vulnerability from cvelistv5 – Published: 2019-08-13 16:48 – Updated: 2024-08-06 08:43
VLAI?
Summary
The contact-form-plugin plugin before 3.96 for WordPress has XSS.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T08:43:42.565Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The contact-form-plugin plugin before 3.96 for WordPress has XSS."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-08-13T16:48:27",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2015-9295",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The contact-form-plugin plugin before 3.96 for WordPress has XSS."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wordpress.org/plugins/contact-form-plugin/#developers",
"refsource": "MISC",
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2015-9295",
"datePublished": "2019-08-13T16:48:27",
"dateReserved": "2019-08-12T00:00:00",
"dateUpdated": "2024-08-06T08:43:42.565Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-7475 (GCVE-0-2013-7475)
Vulnerability from cvelistv5 – Published: 2019-08-13 16:47 – Updated: 2024-08-06 18:09
VLAI?
Summary
The contact-form-plugin plugin before 3.52 for WordPress has XSS.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T18:09:16.901Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The contact-form-plugin plugin before 3.52 for WordPress has XSS."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-08-13T16:47:59",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-7475",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The contact-form-plugin plugin before 3.52 for WordPress has XSS."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wordpress.org/plugins/contact-form-plugin/#developers",
"refsource": "MISC",
"url": "https://wordpress.org/plugins/contact-form-plugin/#developers"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-7475",
"datePublished": "2019-08-13T16:47:59",
"dateReserved": "2019-08-12T00:00:00",
"dateUpdated": "2024-08-06T18:09:16.901Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-2171 (GCVE-0-2017-2171)
Vulnerability from cvelistv5 – Published: 2017-05-22 16:00 – Updated: 2024-08-05 13:48
VLAI?
Summary
Cross-site scripting vulnerability in Captcha prior to version 4.3.0, Car Rental prior to version 1.0.5, Contact Form Multi prior to version 1.2.1, Contact Form prior to version 4.0.6, Contact Form to DB prior to version 1.5.7, Custom Admin Page prior to version 0.1.2, Custom Fields Search prior to version 1.3.2, Custom Search prior to version 1.36, Donate prior to version 2.1.1, Email Queue prior to version 1.1.2, Error Log Viewer prior to version 1.0.6, Facebook Button prior to version 2.54, Featured Posts prior to version 1.0.1, Gallery Categories prior to version 1.0.9, Gallery prior to version 4.5.0, Google +1 prior to version 1.3.4, Google AdSense prior to version 1.44, Google Analytics prior to version 1.7.1, Google Captcha (reCAPTCHA) prior to version 1.28, Google Maps prior to version 1.3.6, Google Shortlink prior to version 1.5.3, Google Sitemap prior to version 3.0.8, Htaccess prior to version 1.7.6, Job Board prior to version 1.1.3, Latest Posts prior to version 0.3, Limit Attempts prior to version 1.1.8, LinkedIn prior to version 1.0.5, Multilanguage prior to version 1.2.2, PDF & Print prior to version 1.9.4, Pagination prior to version 1.0.7, Pinterest prior to version 1.0.5, Popular Posts prior to version 1.0.5, Portfolio prior to version 2.4, Post to CSV prior to version 1.3.1, Profile Extra prior to version 1.0.7. PromoBar prior to version 1.1.1, Quotes and Tips prior to version 1.32, Re-attacher prior to version 1.0.9, Realty prior to version 1.1.0, Relevant - Related Posts prior to version 1.2.0, Sender prior to version 1.2.1, SMTP prior to version 1.1.0, Social Buttons Pack prior to version 1.1.1, Subscriber prior to version 1.3.5, Testimonials prior to version 0.1.9, Timesheet prior to version 0.1.5, Twitter Button prior to version 2.55, User Role prior to version 1.5.6, Updater prior to version 1.35, Visitors Online prior to version 1.0.0, and Zendesk Help Center prior to version 1.0.5 allows remote attackers to inject arbitrary web script or HTML via the function to display the BestWebSoft menu.
Severity ?
No CVSS data available.
CWE
- Cross-site scripting
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| BestWebSoft | Captcha |
Affected:
prior to version 4.3.0
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T13:48:03.789Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "JVNDB-2017-000094",
"tags": [
"third-party-advisory",
"x_refsource_JVNDB",
"x_transferred"
],
"url": "http://jvndb.jvn.jp/jvndb/JVNDB-2017-000094"
},
{
"name": "JVN#24834813",
"tags": [
"third-party-advisory",
"x_refsource_JVN",
"x_transferred"
],
"url": "https://jvn.jp/en/jp/JVN24834813/index.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Captcha",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 4.3.0"
}
]
},
{
"product": "Car Rental",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.0.5"
}
]
},
{
"product": "Contact Form Multi",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.2.1"
}
]
},
{
"product": "Contact Form",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 4.0.6"
}
]
},
{
"product": "Contact Form to DB",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.5.7"
}
]
},
{
"product": "Custom Admin Page",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 0.1.2"
}
]
},
{
"product": "Custom Fields Search",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.3.2"
}
]
},
{
"product": "Custom Search",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.36"
}
]
},
{
"product": "Donate",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 2.1.1"
}
]
},
{
"product": "Email Queue",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.1.2"
}
]
},
{
"product": "Error Log Viewer",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.0.6"
}
]
},
{
"product": "Facebook Button",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 2.54"
}
]
},
{
"product": "Featured Posts",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.0.1"
}
]
},
{
"product": "Gallery Categories",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.0.9"
}
]
},
{
"product": "Gallery",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 4.5.0"
}
]
},
{
"product": "Google +1",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.3.4"
}
]
},
{
"product": "Google AdSense",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.44"
}
]
},
{
"product": "Google Analytics",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.7.1"
}
]
},
{
"product": "Google Captcha (reCAPTCHA)",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.28"
}
]
},
{
"product": "Google Maps",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.3.6"
}
]
},
{
"product": "Google Shortlink",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.5.3"
}
]
},
{
"product": "Google Sitemap",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 3.0.8"
}
]
},
{
"product": "Htaccess",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.7.6"
}
]
},
{
"product": "Job Board",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.1.3"
}
]
},
{
"product": "Latest Posts",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 0.3"
}
]
},
{
"product": "Limit Attempts",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.1.8"
}
]
},
{
"product": "LinkedIn",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.0.5"
}
]
},
{
"product": "Multilanguage",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.2.2"
}
]
},
{
"product": "PDF \u0026 Print",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.9.4"
}
]
},
{
"product": "Pagination",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.0.7"
}
]
},
{
"product": "Pinterest",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.0.5"
}
]
},
{
"product": "Popular Posts",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.0.5"
}
]
},
{
"product": "Portfolio",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 2.4"
}
]
},
{
"product": "Post to CSV",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.3.1"
}
]
},
{
"product": "Profile Extra",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.0.7"
}
]
},
{
"product": "PromoBar",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.1.1"
}
]
},
{
"product": "Quotes and Tips",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.32"
}
]
},
{
"product": "Re-attacher",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.0.9"
}
]
},
{
"product": "Realty",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.1.0"
}
]
},
{
"product": "Relevant - Related Posts",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.2.0"
}
]
},
{
"product": "Sender",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.2.1"
}
]
},
{
"product": "SMTP",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.1.0"
}
]
},
{
"product": "Social Buttons Pack",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.1.1"
}
]
},
{
"product": "Subscriber",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.3.5"
}
]
},
{
"product": "Testimonials",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 0.1.9"
}
]
},
{
"product": "Timesheet",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 0.1.5"
}
]
},
{
"product": "Twitter Button",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 2.55"
}
]
},
{
"product": "User Role",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.5.6"
}
]
},
{
"product": "Updater",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.35"
}
]
},
{
"product": "Visitors Online",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.0.0"
}
]
},
{
"product": "Zendesk Help Center",
"vendor": "BestWebSoft",
"versions": [
{
"status": "affected",
"version": "prior to version 1.0.5"
}
]
}
],
"datePublic": "2017-05-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting vulnerability in Captcha prior to version 4.3.0, Car Rental prior to version 1.0.5, Contact Form Multi prior to version 1.2.1, Contact Form prior to version 4.0.6, Contact Form to DB prior to version 1.5.7, Custom Admin Page prior to version 0.1.2, Custom Fields Search prior to version 1.3.2, Custom Search prior to version 1.36, Donate prior to version 2.1.1, Email Queue prior to version 1.1.2, Error Log Viewer prior to version 1.0.6, Facebook Button prior to version 2.54, Featured Posts prior to version 1.0.1, Gallery Categories prior to version 1.0.9, Gallery prior to version 4.5.0, Google +1 prior to version 1.3.4, Google AdSense prior to version 1.44, Google Analytics prior to version 1.7.1, Google Captcha (reCAPTCHA) prior to version 1.28, Google Maps prior to version 1.3.6, Google Shortlink prior to version 1.5.3, Google Sitemap prior to version 3.0.8, Htaccess prior to version 1.7.6, Job Board prior to version 1.1.3, Latest Posts prior to version 0.3, Limit Attempts prior to version 1.1.8, LinkedIn prior to version 1.0.5, Multilanguage prior to version 1.2.2, PDF \u0026 Print prior to version 1.9.4, Pagination prior to version 1.0.7, Pinterest prior to version 1.0.5, Popular Posts prior to version 1.0.5, Portfolio prior to version 2.4, Post to CSV prior to version 1.3.1, Profile Extra prior to version 1.0.7. PromoBar prior to version 1.1.1, Quotes and Tips prior to version 1.32, Re-attacher prior to version 1.0.9, Realty prior to version 1.1.0, Relevant - Related Posts prior to version 1.2.0, Sender prior to version 1.2.1, SMTP prior to version 1.1.0, Social Buttons Pack prior to version 1.1.1, Subscriber prior to version 1.3.5, Testimonials prior to version 0.1.9, Timesheet prior to version 0.1.5, Twitter Button prior to version 2.55, User Role prior to version 1.5.6, Updater prior to version 1.35, Visitors Online prior to version 1.0.0, and Zendesk Help Center prior to version 1.0.5 allows remote attackers to inject arbitrary web script or HTML via the function to display the BestWebSoft menu."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-site scripting",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-05-22T15:57:01",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"name": "JVNDB-2017-000094",
"tags": [
"third-party-advisory",
"x_refsource_JVNDB"
],
"url": "http://jvndb.jvn.jp/jvndb/JVNDB-2017-000094"
},
{
"name": "JVN#24834813",
"tags": [
"third-party-advisory",
"x_refsource_JVN"
],
"url": "https://jvn.jp/en/jp/JVN24834813/index.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "vultures@jpcert.or.jp",
"ID": "CVE-2017-2171",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Captcha",
"version": {
"version_data": [
{
"version_value": "prior to version 4.3.0"
}
]
}
},
{
"product_name": "Car Rental",
"version": {
"version_data": [
{
"version_value": "prior to version 1.0.5"
}
]
}
},
{
"product_name": "Contact Form Multi",
"version": {
"version_data": [
{
"version_value": "prior to version 1.2.1"
}
]
}
},
{
"product_name": "Contact Form",
"version": {
"version_data": [
{
"version_value": "prior to version 4.0.6"
}
]
}
},
{
"product_name": "Contact Form to DB",
"version": {
"version_data": [
{
"version_value": "prior to version 1.5.7"
}
]
}
},
{
"product_name": "Custom Admin Page",
"version": {
"version_data": [
{
"version_value": "prior to version 0.1.2"
}
]
}
},
{
"product_name": "Custom Fields Search",
"version": {
"version_data": [
{
"version_value": "prior to version 1.3.2"
}
]
}
},
{
"product_name": "Custom Search",
"version": {
"version_data": [
{
"version_value": "prior to version 1.36"
}
]
}
},
{
"product_name": "Donate",
"version": {
"version_data": [
{
"version_value": "prior to version 2.1.1"
}
]
}
},
{
"product_name": "Email Queue",
"version": {
"version_data": [
{
"version_value": "prior to version 1.1.2"
}
]
}
},
{
"product_name": "Error Log Viewer",
"version": {
"version_data": [
{
"version_value": "prior to version 1.0.6"
}
]
}
},
{
"product_name": "Facebook Button",
"version": {
"version_data": [
{
"version_value": "prior to version 2.54"
}
]
}
},
{
"product_name": "Featured Posts",
"version": {
"version_data": [
{
"version_value": "prior to version 1.0.1"
}
]
}
},
{
"product_name": "Gallery Categories",
"version": {
"version_data": [
{
"version_value": "prior to version 1.0.9"
}
]
}
},
{
"product_name": "Gallery",
"version": {
"version_data": [
{
"version_value": "prior to version 4.5.0"
}
]
}
},
{
"product_name": "Google +1",
"version": {
"version_data": [
{
"version_value": "prior to version 1.3.4"
}
]
}
},
{
"product_name": "Google AdSense",
"version": {
"version_data": [
{
"version_value": "prior to version 1.44"
}
]
}
},
{
"product_name": "Google Analytics",
"version": {
"version_data": [
{
"version_value": "prior to version 1.7.1"
}
]
}
},
{
"product_name": "Google Captcha (reCAPTCHA)",
"version": {
"version_data": [
{
"version_value": "prior to version 1.28"
}
]
}
},
{
"product_name": "Google Maps",
"version": {
"version_data": [
{
"version_value": "prior to version 1.3.6"
}
]
}
},
{
"product_name": "Google Shortlink",
"version": {
"version_data": [
{
"version_value": "prior to version 1.5.3"
}
]
}
},
{
"product_name": "Google Sitemap",
"version": {
"version_data": [
{
"version_value": "prior to version 3.0.8"
}
]
}
},
{
"product_name": "Htaccess",
"version": {
"version_data": [
{
"version_value": "prior to version 1.7.6"
}
]
}
},
{
"product_name": "Job Board",
"version": {
"version_data": [
{
"version_value": "prior to version 1.1.3"
}
]
}
},
{
"product_name": "Latest Posts",
"version": {
"version_data": [
{
"version_value": "prior to version 0.3"
}
]
}
},
{
"product_name": "Limit Attempts",
"version": {
"version_data": [
{
"version_value": "prior to version 1.1.8"
}
]
}
},
{
"product_name": "LinkedIn",
"version": {
"version_data": [
{
"version_value": "prior to version 1.0.5"
}
]
}
},
{
"product_name": "Multilanguage",
"version": {
"version_data": [
{
"version_value": "prior to version 1.2.2"
}
]
}
},
{
"product_name": "PDF \u0026 Print",
"version": {
"version_data": [
{
"version_value": "prior to version 1.9.4"
}
]
}
},
{
"product_name": "Pagination",
"version": {
"version_data": [
{
"version_value": "prior to version 1.0.7"
}
]
}
},
{
"product_name": "Pinterest",
"version": {
"version_data": [
{
"version_value": "prior to version 1.0.5"
}
]
}
},
{
"product_name": "Popular Posts",
"version": {
"version_data": [
{
"version_value": "prior to version 1.0.5"
}
]
}
},
{
"product_name": "Portfolio",
"version": {
"version_data": [
{
"version_value": "prior to version 2.4"
}
]
}
},
{
"product_name": "Post to CSV",
"version": {
"version_data": [
{
"version_value": "prior to version 1.3.1"
}
]
}
},
{
"product_name": "Profile Extra",
"version": {
"version_data": [
{
"version_value": "prior to version 1.0.7"
}
]
}
},
{
"product_name": "PromoBar",
"version": {
"version_data": [
{
"version_value": "prior to version 1.1.1"
}
]
}
},
{
"product_name": "Quotes and Tips",
"version": {
"version_data": [
{
"version_value": "prior to version 1.32"
}
]
}
},
{
"product_name": "Re-attacher",
"version": {
"version_data": [
{
"version_value": "prior to version 1.0.9"
}
]
}
},
{
"product_name": "Realty",
"version": {
"version_data": [
{
"version_value": "prior to version 1.1.0"
}
]
}
},
{
"product_name": "Relevant - Related Posts",
"version": {
"version_data": [
{
"version_value": "prior to version 1.2.0"
}
]
}
},
{
"product_name": "Sender",
"version": {
"version_data": [
{
"version_value": "prior to version 1.2.1"
}
]
}
},
{
"product_name": "SMTP",
"version": {
"version_data": [
{
"version_value": "prior to version 1.1.0"
}
]
}
},
{
"product_name": "Social Buttons Pack",
"version": {
"version_data": [
{
"version_value": "prior to version 1.1.1"
}
]
}
},
{
"product_name": "Subscriber",
"version": {
"version_data": [
{
"version_value": "prior to version 1.3.5"
}
]
}
},
{
"product_name": "Testimonials",
"version": {
"version_data": [
{
"version_value": "prior to version 0.1.9"
}
]
}
},
{
"product_name": "Timesheet",
"version": {
"version_data": [
{
"version_value": "prior to version 0.1.5"
}
]
}
},
{
"product_name": "Twitter Button",
"version": {
"version_data": [
{
"version_value": "prior to version 2.55"
}
]
}
},
{
"product_name": "User Role",
"version": {
"version_data": [
{
"version_value": "prior to version 1.5.6"
}
]
}
},
{
"product_name": "Updater",
"version": {
"version_data": [
{
"version_value": "prior to version 1.35"
}
]
}
},
{
"product_name": "Visitors Online",
"version": {
"version_data": [
{
"version_value": "prior to version 1.0.0"
}
]
}
},
{
"product_name": "Zendesk Help Center",
"version": {
"version_data": [
{
"version_value": "prior to version 1.0.5"
}
]
}
}
]
},
"vendor_name": "BestWebSoft"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting vulnerability in Captcha prior to version 4.3.0, Car Rental prior to version 1.0.5, Contact Form Multi prior to version 1.2.1, Contact Form prior to version 4.0.6, Contact Form to DB prior to version 1.5.7, Custom Admin Page prior to version 0.1.2, Custom Fields Search prior to version 1.3.2, Custom Search prior to version 1.36, Donate prior to version 2.1.1, Email Queue prior to version 1.1.2, Error Log Viewer prior to version 1.0.6, Facebook Button prior to version 2.54, Featured Posts prior to version 1.0.1, Gallery Categories prior to version 1.0.9, Gallery prior to version 4.5.0, Google +1 prior to version 1.3.4, Google AdSense prior to version 1.44, Google Analytics prior to version 1.7.1, Google Captcha (reCAPTCHA) prior to version 1.28, Google Maps prior to version 1.3.6, Google Shortlink prior to version 1.5.3, Google Sitemap prior to version 3.0.8, Htaccess prior to version 1.7.6, Job Board prior to version 1.1.3, Latest Posts prior to version 0.3, Limit Attempts prior to version 1.1.8, LinkedIn prior to version 1.0.5, Multilanguage prior to version 1.2.2, PDF \u0026 Print prior to version 1.9.4, Pagination prior to version 1.0.7, Pinterest prior to version 1.0.5, Popular Posts prior to version 1.0.5, Portfolio prior to version 2.4, Post to CSV prior to version 1.3.1, Profile Extra prior to version 1.0.7. PromoBar prior to version 1.1.1, Quotes and Tips prior to version 1.32, Re-attacher prior to version 1.0.9, Realty prior to version 1.1.0, Relevant - Related Posts prior to version 1.2.0, Sender prior to version 1.2.1, SMTP prior to version 1.1.0, Social Buttons Pack prior to version 1.1.1, Subscriber prior to version 1.3.5, Testimonials prior to version 0.1.9, Timesheet prior to version 0.1.5, Twitter Button prior to version 2.55, User Role prior to version 1.5.6, Updater prior to version 1.35, Visitors Online prior to version 1.0.0, and Zendesk Help Center prior to version 1.0.5 allows remote attackers to inject arbitrary web script or HTML via the function to display the BestWebSoft menu."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Cross-site scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "JVNDB-2017-000094",
"refsource": "JVNDB",
"url": "http://jvndb.jvn.jp/jvndb/JVNDB-2017-000094"
},
{
"name": "JVN#24834813",
"refsource": "JVN",
"url": "https://jvn.jp/en/jp/JVN24834813/index.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2017-2171",
"datePublished": "2017-05-22T16:00:00",
"dateReserved": "2016-12-01T00:00:00",
"dateUpdated": "2024-08-05T13:48:03.789Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}