CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 10/04/2023 |
| CVE-2012-10012 | 높음8.8 | A vulnerability has been found in BestWebSoft Facebook Like Button up to 2.13 and classified as problematic. Affected by this vulnerability is the function fcbk_bttn_plgn_settings_page of the file facebook-button-plugin.php. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The | 10/04/2023 |
| CVE-2014-125095 | 보통6.1 | A vulnerability was found in BestWebSoft Contact Form Plugin 1.3.4 on WordPress and classified as problematic. Affected by this issue is the function bws_add_menu_render of the file bws_menu/bws_menu.php. The manipulation of the argument bwsmn_form_email leads to cross site scripting. The attack may be launched remotel | 09/04/2023 |
| CVE-2012-10010 | 높음8.8 | A vulnerability was found in BestWebSoft Contact Form 3.21. It has been classified as problematic. This affects the function cntctfrm_settings_page of the file contact_form.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 3.22 is able to add | 09/04/2023 |
| CVE-2013-10022 | 보통6.1 | A vulnerability, which was classified as problematic, has been found in BestWebSoft Contact Form Plugin 3.51 on WordPress. Affected by this issue is the function cntctfrm_display_form/cntctfrm_check_form of the file contact_form.php. The manipulation leads to cross site scripting. The attack may be launched remotely. U | 05/04/2023 |
| CVE-2023-0820 | 높음8.8 | The User Role by BestWebSoft WordPress plugin before 1.6.7 does not protect against CSRF in requests to update role capabilities, leading to arbitrary privilege escalation of any role. | 03/04/2023 |
| CVE-2022-3393 | 심각9.8 | The Post to CSV by BestWebSoft WordPress plugin through 1.4.0 does not properly escape fields when exporting data as CSV, leading to a CSV injection | 25/10/2022 |
| CVE-2021-25121 | 보통6.5 | The Rating by BestWebSoft WordPress plugin before 1.6 does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service on the post/page when a user submit such rating | 20/06/2022 |
| CVE-2017-20055 | 보통5.4 | A vulnerability classified as problematic has been found in BestWebSoft Contact Form Plugin 4.0.0. This affects an unknown part. The manipulation leads to basic cross site scripting (Stored). It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to versi | 16/06/2022 |
| CVE-2021-24966 | 보통4.9 | The Error Log Viewer WordPress plugin through 1.1.1 does not validate the path of the log file to clear, allowing high privilege users to clear arbitrary files on the web server, including those outside of the blog folder | 14/03/2022 |
| CVE-2021-24761 | 보통6.5 | The Error Log Viewer WordPress plugin before 1.1.2 does not perform nonce check when deleting a log file and does not have path traversal prevention, which could allow attackers to make a logged in admin delete arbitrary text files on the web server. | 01/02/2022 |
| CVE-2021-24350 | 보통6.1 | The Visitors WordPress plugin through 0.3 is affected by an Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability. The plugin would display the user's user agent string without validation or encoding within the WordPress admin panel. | 14/06/2021 |
| CVE-2020-8658 | 높음8.8 | The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccess_editor CSRF. The flag htccss_nonce_name passes the nonce to WordPress but the plugin does not validate it correctly, resulting in a wrong implementation of anti-CSRF protection. In this way, an attack | 06/02/2020 |
| CVE-2015-9385 | 보통6.1 | The quotes-and-tips plugin before 1.20 for WordPress has XSS. | 20/09/2019 |
| CVE-2015-9384 | 보통6.1 | The relevant plugin before 1.0.8 for WordPress has XSS. | 20/09/2019 |
| CVE-2017-18590 | 보통6.1 | The timesheet plugin before 0.1.5 for WordPress has multiple XSS issues. | 27/08/2019 |
| CVE-2015-9335 | 심각9.8 | The limit-attempts plugin before 1.1.1 for WordPress has SQL injection during IP address handling. | 22/08/2019 |
| CVE-2013-7481 | 보통6.1 | The contact-form-plugin plugin before 3.3.5 for WordPress has XSS. | 22/08/2019 |