CVE-2014-125095: BestWebSoft Contact Form Plugin bws_menu.php bws_add_menu_render cross site scripting

Published Apr 9, 2023

Updated

A vulnerability was found in BestWebSoft Contact Form Plugin 1.3.4 on WordPress and classified as problematic. Affected by this issue is the function bwsaddmenurender of the file bwsmenu/bwsmenu.php. The manipulation of the argument bwsmnformemail leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.3.7 is able to address this issue. The name of the patch is 4d531f74b4a801c805dc80360d4ea1312e9a278f. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-225320.

Affected Software

1 affected component

Bestwebsoft Contact Form Wordpress=1.3.4

Remediation

Patch Available

https://github.com/wp-plugins/contact-form-plugin/commit/4d531f74b4a801c805dc80360d4ea1312e9a278f

Event History

Apr 9, 2023

CVE Published

via MITRE·05:31 AM

Data Sourced

via MITRE·05:31 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2014-125095.

What is the severity level of CVE-2014-125095?

CVE-2014-125095 has a severity level of medium.

What is the affected software for CVE-2014-125095?

The affected software for CVE-2014-125095 is BestWebSoft Contact Form Plugin 1.3.4 on WordPress.

What is the CWE category for CVE-2014-125095?

The CWE category for CVE-2014-125095 is CWE-79.

How can I fix CVE-2014-125095?

To fix CVE-2014-125095, update the BestWebSoft Contact Form Plugin to a version that includes the necessary security patches.