CVE-2014-125095: BestWebSoft Contact Form Plugin bws_menu.php bws_add_menu_render cross site scripting
First published: Sun Apr 09 2023(Updated: )
A vulnerability was found in BestWebSoft Contact Form Plugin 1.3.4 on WordPress and classified as problematic. Affected by this issue is the function bws_add_menu_render of the file bws_menu/bws_menu.php. The manipulation of the argument bwsmn_form_email leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.3.7 is able to address this issue. The name of the patch is 4d531f74b4a801c805dc80360d4ea1312e9a278f. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-225320.
Credit: cna@vuldb.com cna@vuldb.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Bestwebsoft Contact Form | =1.3.4 | |
| =1.3.4 |
Remedy
https://github.com/wp-plugins/contact-form-plugin/commit/4d531f74b4a801c805dc80360d4ea1312e9a278f
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2014-125095.
What is the severity level of CVE-2014-125095?
CVE-2014-125095 has a severity level of medium.
What is the affected software for CVE-2014-125095?
The affected software for CVE-2014-125095 is BestWebSoft Contact Form Plugin 1.3.4 on WordPress.
What is the CWE category for CVE-2014-125095?
The CWE category for CVE-2014-125095 is CWE-79.
How can I fix CVE-2014-125095?
To fix CVE-2014-125095, update the BestWebSoft Contact Form Plugin to a version that includes the necessary security patches.
- collector/nvd-index
- agent/author
- agent/type
- agent/weakness
- agent/remedy
- agent/references
- agent/description
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/title
- agent/tags
- agent/first-publish-date
- agent/event
- vendor/bestwebsoft
- canonical/bestwebsoft contact form
- version/bestwebsoft contact form/1.3.4