PT-2023-10163 · Bestwebsoft · Bestwebsoft Contact Form Plugin

Published 2023-04-09 · Updated 2024-05-17 · CVE-2014-125095

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions BestWebSoft Contact Form Plugin version 1.3.4

Description A vulnerability was found in the BestWebSoft Contact Form Plugin and classified as problematic. The issue affects the function bws add menu render of the file bws menu/bws menu.php. The manipulation of the argument bwsmn form email leads to cross-site scripting. The attack may be launched remotely. Upgrading to version 1.3.7 is able to address this issue.

Recommendations For BestWebSoft Contact Form Plugin version 1.3.4, upgrade to version 1.3.7 to address the issue. As a temporary workaround, consider restricting the use of the bws add menu render function until a patch is applied. Avoid using the argument bwsmn form email in the affected function until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2014-125095

Affected Products

Bestwebsoft Contact Form Plugin

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2014-125095 · Security Note
• https://github.com/wp-plugins/contact-form-plugin/commit/4d531f74b4a801c805dc80360d4ea1312e9a278f · Patch
• https://t.me/cvenotify/61959 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-125095 · Note
• https://t.me/cvenotify/47846 · Telegram Post
• https://vuldb.com/?id.225320 · Note
• https://vuldb.com/?ctiid.225320 · Note