Lucene search

VulDBCVE-2014-125095

HistoryApr 09, 2023 - 6:15 a.m.

CVE-2014-125095

2023-04-0906:15:10

CWE-79

VulDB

web.nvd.nist.gov

vulnerability

bestwebsoft

contact form plugin

wordpress

cross site scripting

remote attack

upgrade

patch

4d531f74b4a801c805dc80360d4ea1312e9a278f

vdb-225320

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

39.1%

JSON

A vulnerability was found in BestWebSoft Contact Form Plugin 1.3.4 on WordPress and classified as problematic. Affected by this issue is the function bws_add_menu_render of the file bws_menu/bws_menu.php. The manipulation of the argument bwsmn_form_email leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.3.7 is able to address this issue. The name of the patch is 4d531f74b4a801c805dc80360d4ea1312e9a278f. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-225320.

Affected configurations

Nvd

Vulners

Node

bestwebsoftcontact_formMatch1.3.4wordpress

VendorProductVersionCPE
bestwebsoftcontact_form1.3.4cpe:2.3:a:bestwebsoft:contact_form:1.3.4:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
bestwebsoft	contact_form	1.3.4	cpe:2.3:a:bestwebsoft:contact_form:1.3.4:::::wordpress::

CNA Affected

[
  {
    "vendor": "BestWebSoft",
    "product": "Contact Form Plugin",
    "versions": [
      {
        "version": "1.3.4",
        "status": "affected"
      }
    ]
  }
]

References

github.com/wp-plugins/contact-form-plugin/commit/4d531f74b4a801c805dc80360d4ea1312e9a278f

vuldb.com/?ctiid.225320

vuldb.com/?id.225320

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

39.1%

JSON

Related for CVE-2014-125095