CVE-2017-2171

Cross-site scripting vulnerability in Captcha prior to version 4.3.0, Car Rental prior to version 1.0.5, Contact Form Multi prior to version 1.2.1, Contact Form prior to version 4.0.6, Contact Form to DB prior to version 1.5.7, Custom Admin Page prior to version 0.1.2, Custom Fields Search prior ...

CVE-2017-2171

CVE-2017-2171 detail: A cross-site scripting vulnerability affects BestWebSoft WordPress plugins that display the BestWebSoft menu. The issue arises from a common function used to render the menu (CWE-79), enabling remote attackers to execute arbitrary script in a logged-in user’s browser. Affect...

WordPress BestWebSoft Captcha Cross-Site Scripting Vulnerability

WordPress is the WordPress Software Foundation a set of blogging platform developed using the PHP language, the platform supports in PHP and MySQL servers to set up a personal blog site.BestWebSoft Captcha is one of the website back-end CAPTCHA plugin. A cross-site scripting vulnerability exists ...

Multiple BestWebSoft WordPress plugins vulnerable to cross-site scripting

Overview Multiple WordPress Plugins provided by BestWebSoft use a common function for displaying the BestWebSoft menu. This function contains a cross-site scripting vulnerability CWE-79. Chris Liu reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information...

JVN#24834813: Multiple BestWebSoft WordPress plugins vulnerable to cross-site scripting

Multiple WordPress Plugins provided by BestWebSoft use a common function for displaying the BestWebSoft menu. This function contains a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the logged in user's web browser. Solution Update the plugin Update the...

WordPress User Role by BestWebSoft Plugin <= 1.5.1 - Reflected Cross-Site Scripting (XSS) Vulnerability

A Reflected Cross-Site Scripting XSS Vulnerability was found in WordPress User Role by BestWebSoft Plugin in version 1.5.1. In the file /user-role.php, there's no escaping done when variables are echoed. Solution Update the plugin...

Multiple BestWebSoft Plugins - Authenticated Cross-Site Scripting (XSS)

PoC http://www.example.com/wp-admin/admin.php?page=bwspanel=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%2842%29%3C%2Fscript%3E...

Multiple BestWebSoft Plugins - Authenticated Cross-Site Scripting (XSS)

http://www.example.com/wp-admin/admin.php?page=bwspanel&category=%22%3E%3C%2Fscript%3E%3Cscript%3Ealert%2842%29%3C%2Fscript%3E...

Contact Form by BestWebSoft <= 4.0.1 - Stored Cross-Site Scripting (XSS)

The Contact Form by BestWebSoft WordPress plugin was affected by a Stored Cross-Site Scripting XSS security vulnerability...

WordPress BestWebSoft Google Maps 1.2.1 Cross Site Scripting

Plugin Name : BestWebSoft Google Maps Effected Version : 1.2.1 and most probably lower version's if any Vulnerability : A3-Cross-Site Scripting XSS Identified by : Madhu Akula Technical Details Minimum Level of Access Required : Administrator PoC - Proof of Concept : The following fields put the...

WordPress Email Queue 1.0.0 Cross Site Request Forgery

Plugin Name : Email Queue A8-Cross-SiteRequestForgeryCSRF Effected Version : 1.0.0 and most probably lower version's if any Vulnerability : A8-Cross-Site Request Forgery CSRF Identified by : Madhu Akula Technical Details Minimum Level of Access Required : Unauthenticated PoC - Proof of Concept : ...

WordPress Limit Attempts 1.0.3 Cross Site Request Forgery

Plugin Name : WP Limit Attempts A8-Cross-SiteRequestForgeryCSRF Effected Version : 1.0.3 and most probably lower version's if any Vulnerability : A8-Cross-Site Request Forgery CSRF Identified by : Madhu Akula Technical Details Minimum Level of Access Required : Unauthenticated PoC - Proof of...

WordPress Limit Attempts 1.0.3 Cross Site Scripting

Plugin Name : Limit Attempts Effected Version : 1.0.3 and most probably lower version's if any Vulnerability : A3-Cross-Site Scripting XSS Identified by : Madhu Akula Technical Details Minimum Level of Access Required : Administrator PoC - Proof of Concept : The following fields put the payload a...

WordPress Contact Form To DB 1.4.0 Cross Site Scripting

Plugin Name : Contact Form To DB Effected Version : 1.4.0 and most probably lower version's if any Vulnerability : A3-Cross-Site Scripting XSS Identified by : Madhu Akula Technical Details Minimum Level of Access Required : Administrator PoC - Proof of Concept : The following field put the payloa...

Visitors Online < 0.4 - SQL Injection

The Visitors Online by BestWebSoft WordPress plugin was affected by a SQL Injection security vulnerability...

Limit Attempts < 1.1.1 - SQL Injection

The Limit Attempts by BestWebSoft WordPress plugin was affected by a SQL Injection security vulnerability...

Relevant Related Posts <= 1.0.7 - Cross-Site Scripting (XSS)

The Relevant – Related, Featured, Latest, and Popular Posts by BestWebSoft WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

Quotes And Tips <= 1.19 - Cross-Site Scripting (XSS)

The Quotes and Tips by BestWebSoft WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

PDF And Print <= 1.7.4 - Cross-Site Scripting (XSS)

The PDF & Print by BestWebSoft WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability...

Contact Form Plugin < 3.96 - XSS

The Contact Form by BestWebSoft WordPress plugin was affected by a XSS security vulnerability...