WCP Contact Form <= 3.1.0 - Reflected XSS

The plugin does not sanitise and escape the tab parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

WordPress WCP Contact Form Plugin <= 3.1.0 is vulnerable to Cross Site Scripting (XSS)

Software WCP Contact Form Type Plugin Vulnerable versions = 3.1.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-22703 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID b15b6e2cd5a5 Credits Le Ngoc Anh Requir...

CVE-2023-1282

The CVE-2023-1282 entry affects the WordPress plugins “Drag and Drop Multiple File Upload PRO – Contact Form 7 Standard” (before 2.11.1) and “Drag and Drop Multiple File Upload PRO – Contact Form 7 with Remote Storage Integrations” (before 5.0.6.4). Root cause: both plugins do not sanitize/escape...

WordPress Contact Form to DB by BestWebSoft Plugin <= 1.7.0 is vulnerable to Cross Site Scripting (XSS)

Software Contact Form to DB by BestWebSoft Type Plugin Vulnerable versions = 1.7.0 Fixed in 1.7.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 25288bcf13d1 Credits Unknown Required...

WordPress Contact Form to DB by BestWebSoft Plugin <= 1.7.0 is vulnerable to SQL Injection

Software Contact Form to DB by BestWebSoft Type Plugin Vulnerable versions = 1.7.0 Fixed in 1.7.1 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-29096 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 44860e7fab20 Credits easyBug Required privilege...

WordPress plugin Metform Elementor Contact Form Builder 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability...

WordPress plugin Metform Elementor Contact Form Builder 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

WordPress plugin Metform Elementor Contact Form Builder 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability...

CVE-2023-0546

The Contact Form Plugin WordPress plugin before 4.3.25 does not properly sanitize and escape the srcdoc attribute in iframes in it's custom HTML field type, allowing a logged in user with roles as low as contributor to inject arbitrary javascript into a form which will trigger for any visitor to...

CVE-2023-0546

CVE-2023-0546 affects the Contact Form Plugin WordPress plugin (pre-4.3.25). The issue is stored XSS via improper sanitization/escaping of the srcdoc attribute in iframes within the plugin’s custom HTML field, enabling a logged-in user with Contributor+ privileges to inject arbitrary JavaScript t...

PT-2023-16352 · WordPress · Contact-Form-Plugin

Name of the Vulnerable Software and Affected Versions: Contact Form Plugin WordPress plugin versions prior to 4.3.25 Description: The issue allows a logged-in user with roles as low as contributor to inject arbitrary JavaScript into a form. This can be achieved by exploiting the improper...

CVE-2012-10010

A vulnerability was found in BestWebSoft Contact Form 3.21. It has been classified as problematic. This affects the function cntctfrmsettingspage of the file contactform.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version...

Cross site request forgery (csrf)

A vulnerability was found in BestWebSoft Contact Form 3.21. It has been classified as problematic. This affects the function cntctfrmsettingspage of the file contactform.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version...

Cross site scripting

A vulnerability was found in BestWebSoft Contact Form Plugin 1.3.4 on WordPress and classified as problematic. Affected by this issue is the function bwsaddmenurender of the file bwsmenu/bwsmenu.php. The manipulation of the argument bwsmnformemail leads to cross site scripting. The attack may be...

CVE-2014-125095

CVE-2014-125095 affects BestWebSoft Contact Form Plugin for WordPress (plugin version 1.3.4). The vulnerability resides in the function bws_add_menu_render (file bws_menu/bws_menu.php) where manipulation of the bwsmn_form_email parameter leads to cross-site scripting. The issue can be triggered r...

CVE-2014-125095 BestWebSoft Contact Form Plugin bws_menu.php bws_add_menu_render cross site scripting

A vulnerability was found in BestWebSoft Contact Form Plugin 1.3.4 on WordPress and classified as problematic. Affected by this issue is the function bwsaddmenurender of the file bwsmenu/bwsmenu.php. The manipulation of the argument bwsmnformemail leads to cross site scripting. The attack may be...

CVE-2012-10010 BestWebSoft Contact Form contact_form.php cntctfrm_settings_page cross-site request forgery

A vulnerability was found in BestWebSoft Contact Form 3.21. It has been classified as problematic. This affects the function cntctfrmsettingspage of the file contactform.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version...

CVE-2012-10010

The CVE-2012-10010 issue affects BestWebSoft Contact Form 3.21, with a CSRF vulnerability in the cntctfrm_settings_page function of contact_form.php. The vulnerability can be exploited remotely, leading to cross-site request forgery, and is addressed in version 3.22. A patch identifier (8398d96ff...

WordPress Plugin BestWebSoft Contact Form 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

PT-2023-9947 · Bestwebsoft · Bestwebsoft Contact Form

Name of the Vulnerable Software and Affected Versions: BestWebSoft Contact Form version 3.21 Description: A vulnerability was found in the function cntctfrm settings page of the file contact form.php, leading to cross-site request forgery. The attack can be initiated remotely. Recommendations: Fo...