CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 10/04/2023 |
| CVE-2012-10012 | HOCH8.8 | A vulnerability has been found in BestWebSoft Facebook Like Button up to 2.13 and classified as problematic. Affected by this vulnerability is the function fcbk_bttn_plgn_settings_page of the file facebook-button-plugin.php. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The | 10/04/2023 |
| CVE-2014-125095 | MITTEL6.1 | A vulnerability was found in BestWebSoft Contact Form Plugin 1.3.4 on WordPress and classified as problematic. Affected by this issue is the function bws_add_menu_render of the file bws_menu/bws_menu.php. The manipulation of the argument bwsmn_form_email leads to cross site scripting. The attack may be launched remotel | 09/04/2023 |
| CVE-2012-10010 | HOCH8.8 | A vulnerability was found in BestWebSoft Contact Form 3.21. It has been classified as problematic. This affects the function cntctfrm_settings_page of the file contact_form.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 3.22 is able to add | 09/04/2023 |
| CVE-2013-10022 | MITTEL6.1 | A vulnerability, which was classified as problematic, has been found in BestWebSoft Contact Form Plugin 3.51 on WordPress. Affected by this issue is the function cntctfrm_display_form/cntctfrm_check_form of the file contact_form.php. The manipulation leads to cross site scripting. The attack may be launched remotely. U | 05/04/2023 |
| CVE-2023-0820 | HOCH8.8 | The User Role by BestWebSoft WordPress plugin before 1.6.7 does not protect against CSRF in requests to update role capabilities, leading to arbitrary privilege escalation of any role. | 03/04/2023 |
| CVE-2022-3393 | KRITISCH9.8 | The Post to CSV by BestWebSoft WordPress plugin through 1.4.0 does not properly escape fields when exporting data as CSV, leading to a CSV injection | 25/10/2022 |
| CVE-2021-25121 | MITTEL6.5 | The Rating by BestWebSoft WordPress plugin before 1.6 does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service on the post/page when a user submit such rating | 20/06/2022 |
| CVE-2017-20055 | MITTEL5.4 | A vulnerability classified as problematic has been found in BestWebSoft Contact Form Plugin 4.0.0. This affects an unknown part. The manipulation leads to basic cross site scripting (Stored). It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to versi | 16/06/2022 |
| CVE-2021-24966 | MITTEL4.9 | The Error Log Viewer WordPress plugin through 1.1.1 does not validate the path of the log file to clear, allowing high privilege users to clear arbitrary files on the web server, including those outside of the blog folder | 14/03/2022 |
| CVE-2021-24761 | MITTEL6.5 | The Error Log Viewer WordPress plugin before 1.1.2 does not perform nonce check when deleting a log file and does not have path traversal prevention, which could allow attackers to make a logged in admin delete arbitrary text files on the web server. | 01/02/2022 |
| CVE-2021-24350 | MITTEL6.1 | The Visitors WordPress plugin through 0.3 is affected by an Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability. The plugin would display the user's user agent string without validation or encoding within the WordPress admin panel. | 14/06/2021 |
| CVE-2020-8658 | HOCH8.8 | The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccess_editor CSRF. The flag htccss_nonce_name passes the nonce to WordPress but the plugin does not validate it correctly, resulting in a wrong implementation of anti-CSRF protection. In this way, an attack | 06/02/2020 |
| CVE-2015-9385 | MITTEL6.1 | The quotes-and-tips plugin before 1.20 for WordPress has XSS. | 20/09/2019 |
| CVE-2015-9384 | MITTEL6.1 | The relevant plugin before 1.0.8 for WordPress has XSS. | 20/09/2019 |
| CVE-2017-18590 | MITTEL6.1 | The timesheet plugin before 0.1.5 for WordPress has multiple XSS issues. | 27/08/2019 |
| CVE-2015-9335 | KRITISCH9.8 | The limit-attempts plugin before 1.1.1 for WordPress has SQL injection during IP address handling. | 22/08/2019 |
| CVE-2013-7481 | MITTEL6.1 | The contact-form-plugin plugin before 3.3.5 for WordPress has XSS. | 22/08/2019 |