Rating by BestWebSoft < 1.6 - Rating Denial of Service

The plugin does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service on the post/page when a user submit such rating PoC Under Settings - Discussion, uncheck "Comment must be manually approved" Install and Enable Rating BestWebSoft plugin Change...

WordPress Rating by BestWebSoft plugin <= 1.5 - Rating Denial of Service (DoS) vulnerability

Rating Denial of Service DoS vulnerability discovered by Drew Jones in WordPress Rating by BestWebSoft plugin versions = 1.5. Solution Update the WordPress Rating by BestWebSoft plugin to the latest available version at least 1.6...

Rating by BestWebSoft < 1.6 - Rating Denial of Service

The plugin does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service on the post/page when a user submit such rating Under Settings - Discussion, uncheck "Comment must be manually approved" Install and Enable Rating BestWebSoft plugin Change "Enable...

WordPress Error Log Viewer 1.1.1 Plugin - Arbitrary File Clearing (Authenticated) Vulnerability

Exploit Title: WordPress Plugin Error Log Viewer 1.1.1 - Arbitrary File Clearing Authenticated Exploit Author: Ceylan Bozogullarindan Exploit Website: https://bozogullarindan.com Vendor Homepage: https://bestwebsoft.com/ Software Link:...

WordPress Profile Extra Fields by BestWebSoft plugin <= 1.2.3 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by WPScanTeam in WordPress Profile Extra Fields by BestWebSoft plugin versions = 1.2.3. Solution Update the WordPress Profile Extra Fields by BestWebSoft plugin to the latest available version at least 1.2.4...

WordPress BestWebSoft Htaccess Cross-Site Request Forgery Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. htaccess is an access control plugin used in it. WordPress BestWebSoft Htaccess cross-site request forgery vulnerability, an attacker...

CVE-2020-8658

The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccesseditor CSRF. The flag htccssnoncename passes the nonce to WordPress but the plugin does not validate it correctly, resulting in a wrong implementation of anti-CSRF protection. In...

Cross site request forgery (csrf)

The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccesseditor CSRF. The flag htccssnoncename passes the nonce to WordPress but the plugin does not validate it correctly, resulting in a wrong implementation of anti-CSRF protection. In...

CVE-2020-8658

The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccesseditor CSRF. The flag htccssnoncename passes the nonce to WordPress but the plugin does not validate it correctly, resulting in a wrong implementation of anti-CSRF protection. In...

CVE-2020-8658

The CVE concerns WordPress plugin BestWebSoft Htaccess (

WordPress Htaccess by BestWebSoft plugin <= 1.8.1 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability discovered by V1n1v131r4 in WordPress Htaccess by BestWebSoft plugin versions = 1.8.1. Solution Update the WordPress Htaccess by BestWebSoft plugin to the latest available version at least 1.8.2...

Htaccess by BestWebSoft < 1.8.2 - CSRF to edit .htaccess

The Htaccess by BestWebSoft WordPress plugin was affected by a CSRF to edit .htaccess security vulnerability. PoC...

WordPress PDF And Print 2.0.2 Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2018-014 Product: PDF & Print Manufacturer: Bestwebsoft Affected Version: 2.0.2 Tested Version: 2.0.2 Vulnerability Type: Cross-Site-Scripting CWE-79 Risk Level: Medium Solution Status: Fixed Manufacturer Notification: 2018-08-24...

PDF & Print <= 2.0.2 - Unauthenticated Cross-Site-Scripting (XSS)

The PDF & Print by BestWebSoft WordPress plugin was affected by an Unauthenticated Cross-Site-Scripting XSS security vulnerability...

Cross site scripting

Cross-site scripting vulnerability in Captcha prior to version 4.3.0, Car Rental prior to version 1.0.5, Contact Form Multi prior to version 1.2.1, Contact Form prior to version 4.0.6, Contact Form to DB prior to version 1.5.7, Custom Admin Page prior to version 0.1.2, Custom Fields Search prior ...

CVE-2017-2171

CVE-2017-2171 detail: A cross-site scripting vulnerability affects BestWebSoft WordPress plugins that display the BestWebSoft menu. The issue arises from a common function used to render the menu (CWE-79), enabling remote attackers to execute arbitrary script in a logged-in user’s browser. Affect...

CVE-2017-2171

Cross-site scripting vulnerability in Captcha prior to version 4.3.0, Car Rental prior to version 1.0.5, Contact Form Multi prior to version 1.2.1, Contact Form prior to version 4.0.6, Contact Form to DB prior to version 1.5.7, Custom Admin Page prior to version 0.1.2, Custom Fields Search prior ...

WordPress BestWebSoft Captcha Cross-Site Scripting Vulnerability

WordPress is the WordPress Software Foundation a set of blogging platform developed using the PHP language, the platform supports in PHP and MySQL servers to set up a personal blog site.BestWebSoft Captcha is one of the website back-end CAPTCHA plugin. A cross-site scripting vulnerability exists ...

Multiple BestWebSoft WordPress plugins vulnerable to cross-site scripting

Overview Multiple WordPress Plugins provided by BestWebSoft use a common function for displaying the BestWebSoft menu. This function contains a cross-site scripting vulnerability CWE-79. Chris Liu reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information...

JVN#24834813: Multiple BestWebSoft WordPress plugins vulnerable to cross-site scripting

Multiple WordPress Plugins provided by BestWebSoft use a common function for displaying the BestWebSoft menu. This function contains a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the logged in user's web browser. Solution Update the plugin Update the...