CVE-2012-10010 BestWebSoft Contact Form contact_form.php cntctfrm_settings_page cross-site request forgery

A vulnerability was found in BestWebSoft Contact Form 3.21. It has been classified as problematic. This affects the function cntctfrmsettingspage of the file contactform.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version...

CVE-2012-10010

The CVE-2012-10010 issue affects BestWebSoft Contact Form 3.21, with a CSRF vulnerability in the cntctfrm_settings_page function of contact_form.php. The vulnerability can be exploited remotely, leading to cross-site request forgery, and is addressed in version 3.22. A patch identifier (8398d96ff...

WordPress Plugin BestWebSoft Contact Form 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

WordPress Plugin BestWebSoft Facebook Like Button 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress Plugin BestWebSoft Facebook Like...

WordPress Plugin BestWebSoft Contact Form 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2023-9949 · Bestwebsoft · Bestwebsoft Facebook Like Button

Name of the Vulnerable Software and Affected Versions: BestWebSoft Facebook Like Button versions up to 2.13 Description: A vulnerability has been found in the function fcbk bttn plgn settings page of the file facebook-button-plugin.php, leading to cross-site request forgery. The attack can be...

PT-2023-9947 · Bestwebsoft · Bestwebsoft Contact Form

Name of the Vulnerable Software and Affected Versions: BestWebSoft Contact Form version 3.21 Description: A vulnerability was found in the function cntctfrm settings page of the file contact form.php, leading to cross-site request forgery. The attack can be initiated remotely. Recommendations: Fo...

CVE-2013-10022

A vulnerability, which was classified as problematic, has been found in BestWebSoft Contact Form Plugin 3.51 on WordPress. Affected by this issue is the function cntctfrmdisplayform/cntctfrmcheckform of the file contactform.php. The manipulation leads to cross site scripting. The attack may be...

Cross site scripting

A vulnerability, which was classified as problematic, has been found in BestWebSoft Contact Form Plugin 3.51 on WordPress. Affected by this issue is the function cntctfrmdisplayform/cntctfrmcheckform of the file contactform.php. The manipulation leads to cross site scripting. The attack may be...

CVE-2013-10022

CVE-2013-10022 details (mode C): A cross-site scripting vulnerability exists in the BestWebSoft Contact Form Plugin for WordPress, specifically in the functions cntctfrm_display_form/cntctfrm_check_form within contact_form.php. The issue affects version 3.51 and can be triggered remotely. A fix i...

Wordpress Plugin BestWebSoft Contact Form 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2023-10011 · Bestwebsoft · Bestwebsoft Contact Form Plugin

Name of the Vulnerable Software and Affected Versions: BestWebSoft Contact Form Plugin version 3.51 Description: A vulnerability has been found in the BestWebSoft Contact Form Plugin, affecting the function cntctfrm display form/cntctfrm check form of the file contact form.php. This issue leads t...

CVE-2023-0820

The User Role by BestWebSoft WordPress plugin before 1.6.7 does not protect against CSRF in requests to update role capabilities, leading to arbitrary privilege escalation of any role...

CVE-2023-0820 User Role by BestWebSoft < 1.6.7 - Privilege Escalation via CSRF

The User Role by BestWebSoft WordPress plugin before 1.6.7 does not protect against CSRF in requests to update role capabilities, leading to arbitrary privilege escalation of any role...

CVE-2023-0820 User Role by BestWebSoft < 1.6.7 - Privilege Escalation via CSRF

The User Role by BestWebSoft WordPress plugin before 1.6.7 does not protect against CSRF in requests to update role capabilities, leading to arbitrary privilege escalation of any role...

WordPress Plugin BestWebSoft 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

PT-2023-16549 · Bestwebsoft · User Role

Name of the Vulnerable Software and Affected Versions: User Role by BestWebSoft WordPress plugin versions prior to 1.6.7 Description: The issue concerns a lack of protection against Cross-Site Request Forgery CSRF in requests to update role capabilities, leading to arbitrary privilege escalation ...

Gallery by BestWebSoft < 4.7.0 - Author+ SQL Injection

The plugin does not properly escape values used in SQL queries, leading to an Blind SQL Injection vulnerability. The attacker must have at least the privileges of an Author, and the vendor's Slider plugin https://wordpress.org/plugins/slider-bws/ must also be installed for this vulnerability to b...

Gallery by BestWebSoft < 4.7.0 - Author+ Stored Cross-Site Scripting

The plugin does not perform proper sanitization of gallery information, leading to a Stored Cross-Site Scription vulnerability. The attacker must have at least the privileges of the Author role. PoC 1. Go to Galleries Add New. 2. Click "Add Media" and choose or upload an image. 3. When...

Pagination by BestWebSoft < 1.2.3 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...