CVE-2020-8658

The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccesseditor CSRF. The flag htccssnoncename passes the nonce to WordPress but the plugin does not validate it correctly, resulting in a wrong implementation of anti-CSRF protection. In...

WordPress Htaccess by BestWebSoft plugin <= 1.8.1 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability discovered by V1n1v131r4 in WordPress Htaccess by BestWebSoft plugin versions = 1.8.1. Solution Update the WordPress Htaccess by BestWebSoft plugin to the latest available version at least 1.8.2...

Htaccess by BestWebSoft < 1.8.2 - CSRF to edit .htaccess

The Htaccess by BestWebSoft WordPress plugin was affected by a CSRF to edit .htaccess security vulnerability. PoC...

PDF & Print <= 2.0.2 - Unauthenticated Cross-Site-Scripting (XSS)

The PDF & Print by BestWebSoft WordPress plugin was affected by an Unauthenticated Cross-Site-Scripting XSS security vulnerability...

WordPress PDF And Print 2.0.2 Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2018-014 Product: PDF & Print Manufacturer: Bestwebsoft Affected Version: 2.0.2 Tested Version: 2.0.2 Vulnerability Type: Cross-Site-Scripting CWE-79 Risk Level: Medium Solution Status: Fixed Manufacturer Notification: 2018-08-24...

Cross site scripting

Cross-site scripting vulnerability in Captcha prior to version 4.3.0, Car Rental prior to version 1.0.5, Contact Form Multi prior to version 1.2.1, Contact Form prior to version 4.0.6, Contact Form to DB prior to version 1.5.7, Custom Admin Page prior to version 0.1.2, Custom Fields Search prior ...

CVE-2017-2171

CVE-2017-2171 detail: A cross-site scripting vulnerability affects BestWebSoft WordPress plugins that display the BestWebSoft menu. The issue arises from a common function used to render the menu (CWE-79), enabling remote attackers to execute arbitrary script in a logged-in user’s browser. Affect...

CVE-2017-2171

Cross-site scripting vulnerability in Captcha prior to version 4.3.0, Car Rental prior to version 1.0.5, Contact Form Multi prior to version 1.2.1, Contact Form prior to version 4.0.6, Contact Form to DB prior to version 1.5.7, Custom Admin Page prior to version 0.1.2, Custom Fields Search prior ...

WordPress BestWebSoft Captcha Cross-Site Scripting Vulnerability

WordPress is the WordPress Software Foundation a set of blogging platform developed using the PHP language, the platform supports in PHP and MySQL servers to set up a personal blog site.BestWebSoft Captcha is one of the website back-end CAPTCHA plugin. A cross-site scripting vulnerability exists ...

Multiple BestWebSoft WordPress plugins vulnerable to cross-site scripting

Overview Multiple WordPress Plugins provided by BestWebSoft use a common function for displaying the BestWebSoft menu. This function contains a cross-site scripting vulnerability CWE-79. Chris Liu reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information...

JVN#24834813: Multiple BestWebSoft WordPress plugins vulnerable to cross-site scripting

Multiple WordPress Plugins provided by BestWebSoft use a common function for displaying the BestWebSoft menu. This function contains a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the logged in user's web browser. Solution Update the plugin Update the...

WordPress User Role by BestWebSoft Plugin <= 1.5.1 - Reflected Cross-Site Scripting (XSS) Vulnerability

A Reflected Cross-Site Scripting XSS Vulnerability was found in WordPress User Role by BestWebSoft Plugin in version 1.5.1. In the file /user-role.php, there's no escaping done when variables are echoed. Solution Update the plugin...

Multiple BestWebSoft Plugins - Authenticated Cross-Site Scripting (XSS)

PoC http://www.example.com/wp-admin/admin.php?page=bwspanel=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%2842%29%3C%2Fscript%3E...

Multiple BestWebSoft Plugins - Authenticated Cross-Site Scripting (XSS)

http://www.example.com/wp-admin/admin.php?page=bwspanel&category=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%2842%29%3C%2Fscript%3E...

Contact Form by BestWebSoft <= 4.0.1 - Stored Cross-Site Scripting (XSS)

The Contact Form by BestWebSoft WordPress plugin was affected by a Stored Cross-Site Scripting XSS security vulnerability...

WordPress BestWebSoft Google Maps 1.2.1 Cross Site Scripting

Plugin Name : BestWebSoft Google Maps Effected Version : 1.2.1 and most probably lower version's if any Vulnerability : A3-Cross-Site Scripting XSS Identified by : Madhu Akula Technical Details Minimum Level of Access Required : Administrator PoC - Proof of Concept : The following fields put the...

WordPress Email Queue 1.0.0 Cross Site Request Forgery

Plugin Name : Email Queue A8-Cross-SiteRequestForgeryCSRF Effected Version : 1.0.0 and most probably lower version's if any Vulnerability : A8-Cross-Site Request Forgery CSRF Identified by : Madhu Akula Technical Details Minimum Level of Access Required : Unauthenticated PoC - Proof of Concept : ...

WordPress Limit Attempts 1.0.3 Cross Site Scripting

Plugin Name : Limit Attempts Effected Version : 1.0.3 and most probably lower version's if any Vulnerability : A3-Cross-Site Scripting XSS Identified by : Madhu Akula Technical Details Minimum Level of Access Required : Administrator PoC - Proof of Concept : The following fields put the payload a...

WordPress Limit Attempts 1.0.3 Cross Site Request Forgery

Plugin Name : WP Limit Attempts A8-Cross-SiteRequestForgeryCSRF Effected Version : 1.0.3 and most probably lower version's if any Vulnerability : A8-Cross-Site Request Forgery CSRF Identified by : Madhu Akula Technical Details Minimum Level of Access Required : Unauthenticated PoC - Proof of...

WordPress Contact Form To DB 1.4.0 Cross Site Scripting

Plugin Name : Contact Form To DB Effected Version : 1.4.0 and most probably lower version's if any Vulnerability : A3-Cross-Site Scripting XSS Identified by : Madhu Akula Technical Details Minimum Level of Access Required : Administrator PoC - Proof of Concept : The following field put the payloa...