Cross site scripting

A vulnerability classified as problematic has been found in BestWebSoft Contact Form Plugin 4.0.0. This affects an unknown part. The manipulation leads to basic cross site scripting Stored. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be use...

CVE-2017-20055 BestWebSoft Contact Form Plugin Stored cross site scriting

A vulnerability classified as problematic has been found in BestWebSoft Contact Form Plugin 4.0.0. This affects an unknown part. The manipulation leads to basic cross site scripting Stored. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be use...

CVE-2017-20055 BestWebSoft Contact Form Plugin Stored cross site scriting

A vulnerability classified as problematic has been found in BestWebSoft Contact Form Plugin 4.0.0. This affects an unknown part. The manipulation leads to basic cross site scripting Stored. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be use...

CVE-2017-20055

The vulnerability CVE-2017-20055 affects BestWebSoft Contact Form Plugin for WordPress (version 4.0.0). It is described as a stored cross-site scripting (XSS) flaw arising from insufficient input filtering/escaping in the affected component, enabling remote exploitation. Multiple sources confirm ...

WordPress plugin BestWebSoft Contact Form 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

Rating by BestWebSoft < 1.6 - Rating Denial of Service

The plugin does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service on the post/page when a user submit such rating PoC Under Settings - Discussion, uncheck "Comment must be manually approved" Install and Enable Rating BestWebSoft plugin Change...

WordPress Rating by BestWebSoft plugin <= 1.5 - Rating Denial of Service (DoS) vulnerability

Rating Denial of Service DoS vulnerability discovered by Drew Jones in WordPress Rating by BestWebSoft plugin versions = 1.5. Solution Update the WordPress Rating by BestWebSoft plugin to the latest available version at least 1.6...

Rating by BestWebSoft < 1.6 - Rating Denial of Service

The plugin does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service on the post/page when a user submit such rating Under Settings - Discussion, uncheck "Comment must be manually approved" Install and Enable Rating BestWebSoft plugin Change "Enable...

WordPress Error Log Viewer 1.1.1 Plugin - Arbitrary File Clearing (Authenticated) Vulnerability

Exploit Title: WordPress Plugin Error Log Viewer 1.1.1 - Arbitrary File Clearing Authenticated Exploit Author: Ceylan Bozogullarindan Exploit Website: https://bozogullarindan.com Vendor Homepage: https://bestwebsoft.com/ Software Link:...

WordPress Profile Extra Fields by BestWebSoft plugin <= 1.2.3 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by WPScanTeam in WordPress Profile Extra Fields by BestWebSoft plugin versions = 1.2.3. Solution Update the WordPress Profile Extra Fields by BestWebSoft plugin to the latest available version at least 1.2.4...

WordPress BestWebSoft Htaccess Cross-Site Request Forgery Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. htaccess is an access control plugin used in it. WordPress BestWebSoft Htaccess cross-site request forgery vulnerability, an attacker...

CVE-2020-8658

The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccesseditor CSRF. The flag htccssnoncename passes the nonce to WordPress but the plugin does not validate it correctly, resulting in a wrong implementation of anti-CSRF protection. In...

Cross site request forgery (csrf)

The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccesseditor CSRF. The flag htccssnoncename passes the nonce to WordPress but the plugin does not validate it correctly, resulting in a wrong implementation of anti-CSRF protection. In...

CVE-2020-8658

The CVE concerns WordPress plugin BestWebSoft Htaccess (

CVE-2020-8658

The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccesseditor CSRF. The flag htccssnoncename passes the nonce to WordPress but the plugin does not validate it correctly, resulting in a wrong implementation of anti-CSRF protection. In...

WordPress Htaccess by BestWebSoft plugin <= 1.8.1 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability discovered by V1n1v131r4 in WordPress Htaccess by BestWebSoft plugin versions = 1.8.1. Solution Update the WordPress Htaccess by BestWebSoft plugin to the latest available version at least 1.8.2...

Htaccess by BestWebSoft < 1.8.2 - CSRF to edit .htaccess

The Htaccess by BestWebSoft WordPress plugin was affected by a CSRF to edit .htaccess security vulnerability. PoC...

WordPress PDF And Print 2.0.2 Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2018-014 Product: PDF & Print Manufacturer: Bestwebsoft Affected Version: 2.0.2 Tested Version: 2.0.2 Vulnerability Type: Cross-Site-Scripting CWE-79 Risk Level: Medium Solution Status: Fixed Manufacturer Notification: 2018-08-24...

PDF & Print <= 2.0.2 - Unauthenticated Cross-Site-Scripting (XSS)

The PDF & Print by BestWebSoft WordPress plugin was affected by an Unauthenticated Cross-Site-Scripting XSS security vulnerability...

Cross site scripting

Cross-site scripting vulnerability in Captcha prior to version 4.3.0, Car Rental prior to version 1.0.5, Contact Form Multi prior to version 1.2.1, Contact Form prior to version 4.0.6, Contact Form to DB prior to version 1.5.7, Custom Admin Page prior to version 0.1.2, Custom Fields Search prior ...