CVE-2024-2200

The CVE CVE-2024-2200 concerns WordPress plugin Contact Form by BestWebSoft. Affected versions: all up to and including 4.2.8. Root cause: insufficient input sanitization and output escaping leads to Reflected Cross-Site Scripting via the cntctfrm_contact_subject parameter. Impact: unauthenticate...

CVE-2017-18491

The CVE-2017-18491 entry corresponds to the WordPress plugin “Contact Form by BestWebSoft” up to version 4.0.6, which has multiple XSS flaws. The Nuclei template and related sources confirm the vulnerability affects this plugin and describe the impact: authenticated attackers can inject and execu...

CVE-2017-2171

CVE-2017-2171 detail: A cross-site scripting vulnerability affects BestWebSoft WordPress plugins that display the BestWebSoft menu. The issue arises from a common function used to render the menu (CWE-79), enabling remote attackers to execute arbitrary script in a logged-in user’s browser. Affect...

CVE-2015-9295

The WordPress plugin contact-form-plugin is affected by an XSS vulnerability in versions before 3.96. The issue is described across multiple sources (including Red Hat and CVE records) as a client-side script execution vulnerability in the plugin, with no public exploit details provided in the do...

CVE-2012-10010

The CVE-2012-10010 issue affects BestWebSoft Contact Form 3.21, with a CSRF vulnerability in the cntctfrm_settings_page function of contact_form.php. The vulnerability can be exploited remotely, leading to cross-site request forgery, and is addressed in version 3.22. A patch identifier (8398d96ff...

CVE-2016-10869

CVE-2016-10869 affects the WordPress plugin contact-form-plugin up to version 4.0.2 . The vulnerability is an XSS flaw in the plugin (WordPress context), with CVSS v3 base score 6.1 (MEDIUM) and CVSS v2 base score 4.3 (MEDIUM) . Multiple sources (NVD, Red Hat, CNVD, CVE lists, WPVulnDB) corrobora...

CVE-2013-10022

CVE-2013-10022 details (mode C): A cross-site scripting vulnerability exists in the BestWebSoft Contact Form Plugin for WordPress, specifically in the functions cntctfrm_display_form/cntctfrm_check_form within contact_form.php. The issue affects version 3.51 and can be triggered remotely. A fix i...

CVE-2013-7475

CVE-2013-7475 : The WordPress plugin contact-form-plugin is vulnerable to cross-site scripting in all versions before 3.52. The vulnerability is due to an XSS flaw in the plugin and affects the WordPress integration; exploitation details or in-the-wild status are not provided in the documents. No...

CVE-2013-7481

CVE-2013-7481 is a cross-site scripting (XSS) vulnerability in the WordPress plugin contact-form-plugin, affecting versions before 3.3.5. The issue resides in the plugin’s contact_form.php, enabling an attacker to inject script. Remediation: upgrade to version 3.3.5 or later. Other connected sour...

CVE-2014-125095

CVE-2014-125095 affects BestWebSoft Contact Form Plugin for WordPress (plugin version 1.3.4). The vulnerability resides in the function bws_add_menu_render (file bws_menu/bws_menu.php) where manipulation of the bwsmn_form_email parameter leads to cross-site scripting. The issue can be triggered r...

CVE-2017-20055

The vulnerability CVE-2017-20055 affects BestWebSoft Contact Form Plugin for WordPress (version 4.0.0). It is described as a stored cross-site scripting (XSS) flaw arising from insufficient input filtering/escaping in the affected component, enabling remote exploitation. Multiple sources confirm ...