CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 10/04/2023 |
| CVE-2012-10012 | 高危8.8 | A vulnerability has been found in BestWebSoft Facebook Like Button up to 2.13 and classified as problematic. Affected by this vulnerability is the function fcbk_bttn_plgn_settings_page of the file facebook-button-plugin.php. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The | 10/04/2023 |
| CVE-2014-125095 | 中危6.1 | A vulnerability was found in BestWebSoft Contact Form Plugin 1.3.4 on WordPress and classified as problematic. Affected by this issue is the function bws_add_menu_render of the file bws_menu/bws_menu.php. The manipulation of the argument bwsmn_form_email leads to cross site scripting. The attack may be launched remotel | 09/04/2023 |
| CVE-2012-10010 | 高危8.8 | A vulnerability was found in BestWebSoft Contact Form 3.21. It has been classified as problematic. This affects the function cntctfrm_settings_page of the file contact_form.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 3.22 is able to add | 09/04/2023 |
| CVE-2013-10022 | 中危6.1 | A vulnerability, which was classified as problematic, has been found in BestWebSoft Contact Form Plugin 3.51 on WordPress. Affected by this issue is the function cntctfrm_display_form/cntctfrm_check_form of the file contact_form.php. The manipulation leads to cross site scripting. The attack may be launched remotely. U | 05/04/2023 |
| CVE-2023-0820 | 高危8.8 | The User Role by BestWebSoft WordPress plugin before 1.6.7 does not protect against CSRF in requests to update role capabilities, leading to arbitrary privilege escalation of any role. | 03/04/2023 |
| CVE-2022-3393 | 严重9.8 | The Post to CSV by BestWebSoft WordPress plugin through 1.4.0 does not properly escape fields when exporting data as CSV, leading to a CSV injection | 25/10/2022 |
| CVE-2021-25121 | 中危6.5 | The Rating by BestWebSoft WordPress plugin before 1.6 does not validate the submitted rating, allowing submission of long integer, causing a Denial of Service on the post/page when a user submit such rating | 20/06/2022 |
| CVE-2017-20055 | 中危5.4 | A vulnerability classified as problematic has been found in BestWebSoft Contact Form Plugin 4.0.0. This affects an unknown part. The manipulation leads to basic cross site scripting (Stored). It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to versi | 16/06/2022 |
| CVE-2021-24966 | 中危4.9 | The Error Log Viewer WordPress plugin through 1.1.1 does not validate the path of the log file to clear, allowing high privilege users to clear arbitrary files on the web server, including those outside of the blog folder | 14/03/2022 |
| CVE-2021-24761 | 中危6.5 | The Error Log Viewer WordPress plugin before 1.1.2 does not perform nonce check when deleting a log file and does not have path traversal prevention, which could allow attackers to make a logged in admin delete arbitrary text files on the web server. | 01/02/2022 |
| CVE-2021-24350 | 中危6.1 | The Visitors WordPress plugin through 0.3 is affected by an Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability. The plugin would display the user's user agent string without validation or encoding within the WordPress admin panel. | 14/06/2021 |
| CVE-2020-8658 | 高危8.8 | The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccess_editor CSRF. The flag htccss_nonce_name passes the nonce to WordPress but the plugin does not validate it correctly, resulting in a wrong implementation of anti-CSRF protection. In this way, an attack | 06/02/2020 |
| CVE-2015-9385 | 中危6.1 | The quotes-and-tips plugin before 1.20 for WordPress has XSS. | 20/09/2019 |
| CVE-2015-9384 | 中危6.1 | The relevant plugin before 1.0.8 for WordPress has XSS. | 20/09/2019 |
| CVE-2017-18590 | 中危6.1 | The timesheet plugin before 0.1.5 for WordPress has multiple XSS issues. | 27/08/2019 |
| CVE-2015-9335 | 严重9.8 | The limit-attempts plugin before 1.1.1 for WordPress has SQL injection during IP address handling. | 22/08/2019 |
| CVE-2013-7481 | 中危6.1 | The contact-form-plugin plugin before 3.3.5 for WordPress has XSS. | 22/08/2019 |