PDF & Print by BestWebSoft < 1.9.4 - Cross-Site Scripting

The pdf-print plugin before 1.9.4 for WordPress has multiple XSS issues. id: CVE-2017-18528 info: name: PDF & Print by BestWebSoft 1.9.4 - Cross-Site Scripting author: luisfelipe146 severity: medium description: | The pdf-print plugin before 1.9.4 for WordPress has multiple XSS issues. impact: |...

Custom Search by BestWebSoft < 1.36 - Cross-Site Scripting

The custom-search-plugin plugin before 1.36 for WordPress has multiple XSS issues. id: CVE-2017-18494 info: name: Custom Search by BestWebSoft 1.36 - Cross-Site Scripting author: luisfelipe146 severity: medium description: | The custom-search-plugin plugin before 1.36 for WordPress has multiple X...

Google Analytics by BestWebSoft < 1.7.1 - Cross-Site Scripting

The bws-google-analytics plugin before 1.7.1 for WordPress has multiple XSS issues. id: CVE-2017-18556 info: name: Google Analytics by BestWebSoft 1.7.1 - Cross-Site Scripting author: luisfelipe146 severity: medium description: | The bws-google-analytics plugin before 1.7.1 for WordPress has...

PromoBar by BestWebSoft < 1.1.1 - Cross-Site Scripting

The promobar plugin before 1.1.1 for WordPress has multiple XSS issues. id: CVE-2017-18529 info: name: PromoBar by BestWebSoft 1.1.1 - Cross-Site Scripting author: luisfelipe146 severity: medium description: | The promobar plugin before 1.1.1 for WordPress has multiple XSS issues. impact: |...

Zendesk Help Center by BestWebSoft < 1.0.5 - Cross-Site Scripting

The zendesk-help-center plugin before 1.0.5 for WordPress has multiple XSS issues. id: CVE-2017-18542 info: name: Zendesk Help Center by BestWebSoft 1.0.5 - Cross-Site Scripting author: luisfelipe146 severity: medium description: | The zendesk-help-center plugin before 1.0.5 for WordPress has...

BestWebSoft's Twitter < 2.55 - Cross-Site Scripting

The twitter-plugin plugin before 2.55 for WordPress has XSS. id: CVE-2017-18505 info: name: BestWebSoft's Twitter 2.55 - Cross-Site Scripting author: luisfelipe146 severity: medium description: | The twitter-plugin plugin before 2.55 for WordPress has XSS. impact: | Authenticated attackers can...

CVE-2026-2497

The Gallery by BestWebSoft plugin for WordPress is vulnerable to SQL Injection via the 'galleryorderpostid' parameter array keys in all versions up to, and including, 4.7.9. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-2497 Gallery by BestWebSoft <= 4.7.9 - Authenticated (Editor+) SQL Injection via Gallery Image Order Array Keys

The Gallery by BestWebSoft plugin for WordPress is vulnerable to SQL Injection via the 'galleryorderpostid' parameter array keys in all versions up to, and including, 4.7.9. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

EUVD-2026-59925

The Gallery by BestWebSoft plugin for WordPress is vulnerable to SQL Injection via the 'galleryorderpostid' parameter array keys in all versions up to, and including, 4.7.9. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-2497

The CVE concerns The Gallery by BestWebSoft plugin for WordPress, affecting all versions up to 4.7.9. The vulnerability is an SQL Injection via the gallery_order {post_id} parameter array keys, arising from unsanitized array keys stored from $_POST into post meta and later injected into SQL queri...

EUVD-2026-57876

Subscriber Cross Site Scripting XSS in Profile Extra Fields by BestWebSoft = 1.3.4 versions...

CVE-2026-66456 WordPress Profile Extra Fields by BestWebSoft plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in Profile Extra Fields by BestWebSoft = 1.3.4 versions...

CVE-2026-66456

CVE-2026-66456 concerns the WordPress plugin Profile Extra Fields by BestWebSoft , specifically versions ≤ 1.3.4. The vulnerability is a Subscriber Cross Site Scripting (XSS) flaw in the profile extra fields. The provided documents identify the affected product and the vulnerable component but do...

WordPress Profile Extra Fields by BestWebSoft plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by 0xManticore in WordPress Plugin Profile Extra Fields by BestWebSoft versions = 1.3.5...

CVE-2026-3618 Columns by BestWebSoft <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'columns' Shortcode 'id' Attribute

The Columns by BestWebSoft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode attribute of the printclmns shortcode in all versions up to and including 1.0.3. This is due to insufficient input sanitization and output escaping on the 'id' attribute. The...

CVE-2026-3618 Columns by BestWebSoft <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'columns' Shortcode 'id' Attribute

The Columns by BestWebSoft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode attribute of the printclmns shortcode in all versions up to and including 1.0.3. This is due to insufficient input sanitization and output escaping on the 'id' attribute. The...

CVE-2026-3618

The CVE concerns the WordPress plugin Columns by BestWebSoft (

WordPress Columns by BestWebSoft plugin <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'columns' Shortcode 'id' Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'columns' Shortcode 'id' Attribute vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Columns by BestWebSoft versions = 1.0.3...

WordPress plugin Columns by BestWebSoft 跨站脚本漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

WordPress Contact Form by BestWebSoft plugin <= 4.2.8 - Reflected Cross-Site Scripting via cntctfrm_contact_subject vulnerability

Reflected Cross-Site Scripting via cntctfrmcontactsubject vulnerability discovered by Krzysztof Zając - CERT PL in WordPress Plugin Contact Form by BestWebSoft versions = 4.2.8...