Cross-site scripting in BestWebSoft Captcha
Priority LOW 29CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
Cross-site scripting vulnerability in Captcha prior to version 4.3.0, Car Rental prior to version 1.0.5, Contact Form Multi prior to version 1.2.1, Contact Form prior to version 4.0.6, Contact Form to DB prior to version 1.5.7, Custom Admin Page prior to version 0.1.2, Custom Fields Search prior to version 1.3.2, Custom Search prior to version 1.36, Donate prior to version 2.1.1, Email Queue prior to version 1.1.2, Error Log Viewer prior to version 1.0.6, Facebook Button prior to version 2.54, Featured Posts prior to version 1.0.1, Gallery Categories prior to version 1.0.9, Gallery prior to version 4.5.0, Google +1 prior to version 1.3.4, Google AdSense prior to version 1.44, Google Analytics prior to version 1.7.1, Google Captcha (reCAPTCHA) prior to version 1.28, Google Maps prior to version 1.3.6, Google Shortlink prior to version 1.5.3, Google Sitemap prior to version 3.0.8, Htaccess prior to version 1.7.6, Job Board prior to version 1.1.3, Latest Posts prior to version 0.3, Limit Attempts prior to version 1.1.8, LinkedIn prior to version 1.0.5, Multilanguage prior to version 1.2.2, PDF & Print prior to version 1.9.4, Pagination prior to version 1.0.7, Pinterest prior to version 1.0.5, Popular Posts prior to version 1.0.5, Portfolio prior to version 2.4, Post to CSV prior to version 1.3.1, Profile Extra prior to version 1.0.7. PromoBar prior to version 1.1.1, Quotes and Tips prior to version 1.32, Re-attacher prior to version 1.0.9, Realty prior to version 1.1.0, Relevant - Related Posts prior to version 1.2.0, Sender prior to version 1.2.1, SMTP prior to version 1.1.0, Social Buttons Pack prior to version 1.1.1, Subscriber prior to version 1.3.5, Testimonials prior to version 0.1.9, Timesheet prior to version 0.1.5, Twitter Button prior to version 2.55, User Role prior to version 1.5.6, Updater prior to version 1.35, Visitors Online prior to version 1.0.0, and Zendesk Help Center prior to version 1.0.5 allows remote attackers to inject arbitrary web script or HTML via the function to display the BestWebSoft menu.
Why it matters now
EPSS 0.00886 59th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| BestWebSoft | Captcha | prior to version 4.3.0 | — | No fix listed | CNA |
| BestWebSoft | Car Rental | prior to version 1.0.5 | — | No fix listed | CNA |
| BestWebSoft | Contact Form Multi | prior to version 1.2.1 | — | No fix listed | CNA |
| BestWebSoft | Contact Form | prior to version 4.0.6 | — | No fix listed | CNA |
| BestWebSoft | Contact Form to DB | prior to version 1.5.7 | — | No fix listed | CNA |
| BestWebSoft | Custom Admin Page | prior to version 0.1.2 | — | No fix listed | CNA |
| BestWebSoft | Custom Fields Search | prior to version 1.3.2 | — | No fix listed | CNA |
| BestWebSoft | Custom Search | prior to version 1.36 | — | No fix listed | CNA |
| BestWebSoft | Donate | prior to version 2.1.1 | — | No fix listed | CNA |
| BestWebSoft | Email Queue | prior to version 1.1.2 | — | No fix listed | CNA |
| BestWebSoft | Error Log Viewer | prior to version 1.0.6 | — | No fix listed | CNA |
| BestWebSoft | Facebook Button | prior to version 2.54 | — | No fix listed | CNA |
| BestWebSoft | Featured Posts | prior to version 1.0.1 | — | No fix listed | CNA |
| BestWebSoft | Gallery Categories | prior to version 1.0.9 | — | No fix listed | CNA |
| BestWebSoft | Gallery | prior to version 4.5.0 | — | No fix listed | CNA |
| BestWebSoft | Google +1 | prior to version 1.3.4 | — | No fix listed | CNA |
| BestWebSoft | Google AdSense | prior to version 1.44 | — | No fix listed | CNA |
| BestWebSoft | Google Analytics | prior to version 1.7.1 | — | No fix listed | CNA |
| BestWebSoft | Google Captcha (reCAPTCHA) | prior to version 1.28 | — | No fix listed | CNA |
| BestWebSoft | Google Maps | prior to version 1.3.6 | — | No fix listed | CNA |
| BestWebSoft | Google Shortlink | prior to version 1.5.3 | — | No fix listed | CNA |
| BestWebSoft | Google Sitemap | prior to version 3.0.8 | — | No fix listed | CNA |
| BestWebSoft | Htaccess | prior to version 1.7.6 | — | No fix listed | CNA |
| BestWebSoft | Job Board | prior to version 1.1.3 | — | No fix listed | CNA |
| BestWebSoft | Latest Posts | prior to version 0.3 | — | No fix listed | CNA |
| BestWebSoft | Limit Attempts | prior to version 1.1.8 | — | No fix listed | CNA |
| BestWebSoft | prior to version 1.0.5 | — | No fix listed | CNA | |
| BestWebSoft | Multilanguage | prior to version 1.2.2 | — | No fix listed | CNA |
| BestWebSoft | PDF & Print | prior to version 1.9.4 | — | No fix listed | CNA |
| BestWebSoft | Pagination | prior to version 1.0.7 | — | No fix listed | CNA |
| BestWebSoft | prior to version 1.0.5 | — | No fix listed | CNA | |
| BestWebSoft | Popular Posts | prior to version 1.0.5 | — | No fix listed | CNA |
| BestWebSoft | Portfolio | prior to version 2.4 | — | No fix listed | CNA |
| BestWebSoft | Post to CSV | prior to version 1.3.1 | — | No fix listed | CNA |
| BestWebSoft | Profile Extra | prior to version 1.0.7 | — | No fix listed | CNA |
| BestWebSoft | PromoBar | prior to version 1.1.1 | — | No fix listed | CNA |
| BestWebSoft | Quotes and Tips | prior to version 1.32 | — | No fix listed | CNA |
| BestWebSoft | Re-attacher | prior to version 1.0.9 | — | No fix listed | CNA |
| BestWebSoft | Realty | prior to version 1.1.0 | — | No fix listed | CNA |
| BestWebSoft | Relevant - Related Posts | prior to version 1.2.0 | — | No fix listed | CNA |
| BestWebSoft | Sender | prior to version 1.2.1 | — | No fix listed | CNA |
| BestWebSoft | SMTP | prior to version 1.1.0 | — | No fix listed | CNA |
| BestWebSoft | Social Buttons Pack | prior to version 1.1.1 | — | No fix listed | CNA |
| BestWebSoft | Subscriber | prior to version 1.3.5 | — | No fix listed | CNA |
| BestWebSoft | Testimonials | prior to version 0.1.9 | — | No fix listed | CNA |
| BestWebSoft | Timesheet | prior to version 0.1.5 | — | No fix listed | CNA |
| BestWebSoft | Twitter Button | prior to version 2.55 | — | No fix listed | CNA |
| BestWebSoft | User Role | prior to version 1.5.6 | — | No fix listed | CNA |
| BestWebSoft | Updater | prior to version 1.35 | — | No fix listed | CNA |
| BestWebSoft | Visitors Online | prior to version 1.0.0 | — | No fix listed | CNA |
| BestWebSoft | Zendesk Help Center | prior to version 1.0.5 | — | No fix listed | CNA |
- Captcha VendorBestWebSoft Affected prior to version 4.3.0 Fixed in — No fix listed CNA
- Car Rental VendorBestWebSoft Affected prior to version 1.0.5 Fixed in — No fix listed CNA
- Contact Form Multi VendorBestWebSoft Affected prior to version 1.2.1 Fixed in — No fix listed CNA
- Contact Form VendorBestWebSoft Affected prior to version 4.0.6 Fixed in — No fix listed CNA
- Contact Form to DB VendorBestWebSoft Affected prior to version 1.5.7 Fixed in — No fix listed CNA
- Custom Admin Page VendorBestWebSoft Affected prior to version 0.1.2 Fixed in — No fix listed CNA
- Custom Fields Search VendorBestWebSoft Affected prior to version 1.3.2 Fixed in — No fix listed CNA
- Custom Search VendorBestWebSoft Affected prior to version 1.36 Fixed in — No fix listed CNA
- Donate VendorBestWebSoft Affected prior to version 2.1.1 Fixed in — No fix listed CNA
- Email Queue VendorBestWebSoft Affected prior to version 1.1.2 Fixed in — No fix listed CNA
- Error Log Viewer VendorBestWebSoft Affected prior to version 1.0.6 Fixed in — No fix listed CNA
- Facebook Button VendorBestWebSoft Affected prior to version 2.54 Fixed in — No fix listed CNA
- Featured Posts VendorBestWebSoft Affected prior to version 1.0.1 Fixed in — No fix listed CNA
- Gallery Categories VendorBestWebSoft Affected prior to version 1.0.9 Fixed in — No fix listed CNA
- Gallery VendorBestWebSoft Affected prior to version 4.5.0 Fixed in — No fix listed CNA
- Google +1 VendorBestWebSoft Affected prior to version 1.3.4 Fixed in — No fix listed CNA
- Google AdSense VendorBestWebSoft Affected prior to version 1.44 Fixed in — No fix listed CNA
- Google Analytics VendorBestWebSoft Affected prior to version 1.7.1 Fixed in — No fix listed CNA
- Google Captcha (reCAPTCHA) VendorBestWebSoft Affected prior to version 1.28 Fixed in — No fix listed CNA
- Google Maps VendorBestWebSoft Affected prior to version 1.3.6 Fixed in — No fix listed CNA
- Google Shortlink VendorBestWebSoft Affected prior to version 1.5.3 Fixed in — No fix listed CNA
- Google Sitemap VendorBestWebSoft Affected prior to version 3.0.8 Fixed in — No fix listed CNA
- Htaccess VendorBestWebSoft Affected prior to version 1.7.6 Fixed in — No fix listed CNA
- Job Board VendorBestWebSoft Affected prior to version 1.1.3 Fixed in — No fix listed CNA
- Latest Posts VendorBestWebSoft Affected prior to version 0.3 Fixed in — No fix listed CNA
- Limit Attempts VendorBestWebSoft Affected prior to version 1.1.8 Fixed in — No fix listed CNA
- LinkedIn VendorBestWebSoft Affected prior to version 1.0.5 Fixed in — No fix listed CNA
- Multilanguage VendorBestWebSoft Affected prior to version 1.2.2 Fixed in — No fix listed CNA
- PDF & Print VendorBestWebSoft Affected prior to version 1.9.4 Fixed in — No fix listed CNA
- Pagination VendorBestWebSoft Affected prior to version 1.0.7 Fixed in — No fix listed CNA
- Pinterest VendorBestWebSoft Affected prior to version 1.0.5 Fixed in — No fix listed CNA
- Popular Posts VendorBestWebSoft Affected prior to version 1.0.5 Fixed in — No fix listed CNA
- Portfolio VendorBestWebSoft Affected prior to version 2.4 Fixed in — No fix listed CNA
- Post to CSV VendorBestWebSoft Affected prior to version 1.3.1 Fixed in — No fix listed CNA
- Profile Extra VendorBestWebSoft Affected prior to version 1.0.7 Fixed in — No fix listed CNA
- PromoBar VendorBestWebSoft Affected prior to version 1.1.1 Fixed in — No fix listed CNA
- Quotes and Tips VendorBestWebSoft Affected prior to version 1.32 Fixed in — No fix listed CNA
- Re-attacher VendorBestWebSoft Affected prior to version 1.0.9 Fixed in — No fix listed CNA
- Realty VendorBestWebSoft Affected prior to version 1.1.0 Fixed in — No fix listed CNA
- Relevant - Related Posts VendorBestWebSoft Affected prior to version 1.2.0 Fixed in — No fix listed CNA
- Sender VendorBestWebSoft Affected prior to version 1.2.1 Fixed in — No fix listed CNA
- SMTP VendorBestWebSoft Affected prior to version 1.1.0 Fixed in — No fix listed CNA
- Social Buttons Pack VendorBestWebSoft Affected prior to version 1.1.1 Fixed in — No fix listed CNA
- Subscriber VendorBestWebSoft Affected prior to version 1.3.5 Fixed in — No fix listed CNA
- Testimonials VendorBestWebSoft Affected prior to version 0.1.9 Fixed in — No fix listed CNA
- Timesheet VendorBestWebSoft Affected prior to version 0.1.5 Fixed in — No fix listed CNA
- Twitter Button VendorBestWebSoft Affected prior to version 2.55 Fixed in — No fix listed CNA
- User Role VendorBestWebSoft Affected prior to version 1.5.6 Fixed in — No fix listed CNA
- Updater VendorBestWebSoft Affected prior to version 1.35 Fixed in — No fix listed CNA
- Visitors Online VendorBestWebSoft Affected prior to version 1.0.0 Fixed in — No fix listed CNA
- Zendesk Help Center VendorBestWebSoft Affected prior to version 1.0.5 Fixed in — No fix listed CNA
CPE configurations NVD · 51
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:bestwebsoft:captcha:*:*:*:*:*:wordpress:*:* | up to 4.2.9 | Vulnerable | BestWebSoft |
| cpe:2.3:a:bestwebsoft:car_rental:*:*:*:*:*:wordpress:*:* | up to 1.0.4 | Vulnerable | BestWebSoft |
| cpe:2.3:a:bestwebsoft:contact_form:*:*:*:*:*:wordpress:*:* | up to 4.0.5 | Vulnerable | BestWebSoft |
| cpe:2.3:a:bestwebsoft:contact_form_multi:*:*:*:*:*:wordpress:*:* | up to 1.2.0 | Vulnerable | BestWebSoft |
| cpe:2.3:a:bestwebsoft:contact_form_to_db:*:*:*:*:*:wordpress:*:* | up to 1.5.6 | Vulnerable | BestWebSoft |
| cpe:2.3:a:bestwebsoft:custom_admin_page:*:*:*:*:*:wordpress:*:* | up to 0.1.1 | Vulnerable | BestWebSoft |
| cpe:2.3:a:bestwebsoft:custom_fields_search:*:*:*:*:*:wordpress:*:* | up to 1.3.1 | Vulnerable | BestWebSoft |
| cpe:2.3:a:bestwebsoft:custom_search:*:*:*:*:*:wordpress:*:* | up to 1.35 | Vulnerable | BestWebSoft |
| cpe:2.3:a:bestwebsoft:donate:*:*:*:*:*:wordpress:*:* | up to 2.1.0 | Vulnerable | BestWebSoft |
| cpe:2.3:a:bestwebsoft:email_queue:*:*:*:*:*:wordpress:*:* | up to 1.1.1 | Vulnerable | BestWebSoft |
- cpe:2.3:a:bestwebsoft:captcha:*:*:*:*:*:wordpress:*:* Versions up to 4.2.9 Vulnerable ·BestWebSoft
- cpe:2.3:a:bestwebsoft:car_rental:*:*:*:*:*:wordpress:*:* Versions up to 1.0.4 Vulnerable ·BestWebSoft
- cpe:2.3:a:bestwebsoft:contact_form:*:*:*:*:*:wordpress:*:* Versions up to 4.0.5 Vulnerable ·BestWebSoft
- cpe:2.3:a:bestwebsoft:contact_form_multi:*:*:*:*:*:wordpress:*:* Versions up to 1.2.0 Vulnerable ·BestWebSoft
- cpe:2.3:a:bestwebsoft:contact_form_to_db:*:*:*:*:*:wordpress:*:* Versions up to 1.5.6 Vulnerable ·BestWebSoft
- cpe:2.3:a:bestwebsoft:custom_admin_page:*:*:*:*:*:wordpress:*:* Versions up to 0.1.1 Vulnerable ·BestWebSoft
- cpe:2.3:a:bestwebsoft:custom_fields_search:*:*:*:*:*:wordpress:*:* Versions up to 1.3.1 Vulnerable ·BestWebSoft
- cpe:2.3:a:bestwebsoft:custom_search:*:*:*:*:*:wordpress:*:* Versions up to 1.35 Vulnerable ·BestWebSoft
- cpe:2.3:a:bestwebsoft:donate:*:*:*:*:*:wordpress:*:* Versions up to 2.1.0 Vulnerable ·BestWebSoft
- cpe:2.3:a:bestwebsoft:email_queue:*:*:*:*:*:wordpress:*:* Versions up to 1.1.1 Vulnerable ·BestWebSoft
Show 41 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:bestwebsoft:error_log_viewer:*:*:*:*:*:wordpress:*:* | up to 1.0.5 | Vulnerable | BestWebSoft |
| cpe:2.3:a:bestwebsoft:facebook_button:*:*:*:*:*:wordpress:*:* | up to 2.53 | Vulnerable | BestWebSoft |
| cpe:2.3:a:bestwebsoft:featured_posts:*:*:*:*:*:wordpress:*:* | up to 1.0.0 | Vulnerable | BestWebSoft |
| cpe:2.3:a:bestwebsoft:gallery:*:*:*:*:*:wordpress:*:* | up to 4.4.9 | Vulnerable | BestWebSoft |
| cpe:2.3:a:bestwebsoft:gallery_categories:*:*:*:*:*:wordpress:*:* | up to 1.0.8 | Vulnerable | BestWebSoft |
| cpe:2.3:a:bestwebsoft:google_\+1:*:*:*:*:*:wordpress:*:* | up to 1.3.3 | Vulnerable | BestWebSoft |
| cpe:2.3:a:bestwebsoft:google_adsense:*:*:*:*:*:wordpress:*:* | up to 1.43 | Vulnerable | BestWebSoft |
| cpe:2.3:a:bestwebsoft:google_analytics:*:*:*:*:*:wordpress:*:* | up to 1.7.0 | Vulnerable | BestWebSoft |
| cpe:2.3:a:bestwebsoft:google_captcha_\(recaptcha\):*:*:*:*:*:wordpress:*:* | up to 1.27 | Vulnerable | BestWebSoft |
| cpe:2.3:a:bestwebsoft:google_maps:*:*:*:*:*:wordpress:*:* | up to 1.3.5 | Vulnerable | BestWebSoft |
| cpe:2.3:a:bestwebsoft:google_shortlink:*:*:*:*:*:wordpress:*:* | up to 1.5.2 | Vulnerable | BestWebSoft |
| cpe:2.3:a:bestwebsoft:google_sitemap:*:*:*:*:*:wordpress:*:* | up to 3.0.7 | Vulnerable | BestWebSoft |
| cpe:2.3:a:bestwebsoft:htaccess:*:*:*:*:*:wordpress:*:* | up to 1.7.5 | Vulnerable | BestWebSoft |
| cpe:2.3:a:bestwebsoft:job_board:*:*:*:*:*:wordpress:*:* | up to 1.1.2 | Vulnerable | BestWebSoft |
| cpe:2.3:a:bestwebsoft:latest_posts:*:*:*:*:*:wordpress:*:* | up to 0.2 | Vulnerable | BestWebSoft |
| cpe:2.3:a:bestwebsoft:limit_attempts:*:*:*:*:*:wordpress:*:* | up to 1.1.7 | Vulnerable | BestWebSoft |
| cpe:2.3:a:bestwebsoft:linkedin:*:*:*:*:*:wordpress:*:* | up to 1.0.4 | Vulnerable | BestWebSoft |
| cpe:2.3:a:bestwebsoft:multilanguage:*:*:*:*:*:wordpress:*:* | up to 1.2.1 | Vulnerable | BestWebSoft |
| cpe:2.3:a:bestwebsoft:pagination:*:*:*:*:*:wordpress:*:* | up to 1.0.6 | Vulnerable | BestWebSoft |
| cpe:2.3:a:bestwebsoft:pdf_\&_print:*:*:*:*:*:wordpress:*:* | up to 1.9.3 | Vulnerable | BestWebSoft |
| cpe:2.3:a:bestwebsoft:pinterest:*:*:*:*:*:wordpress:*:* | up to 1.0.4 | Vulnerable | BestWebSoft |
| cpe:2.3:a:bestwebsoft:popular_posts:*:*:*:*:*:wordpress:*:* | up to 1.0.4 | Vulnerable | BestWebSoft |
| cpe:2.3:a:bestwebsoft:portfolio:*:*:*:*:*:wordpress:*:* | up to 2.3 | Vulnerable | BestWebSoft |
| cpe:2.3:a:bestwebsoft:post_to_csv:*:*:*:*:*:wordpress:*:* | up to 1.3.0 | Vulnerable | BestWebSoft |
| cpe:2.3:a:bestwebsoft:profile_extra:*:*:*:*:*:wordpress:*:* | up to 1.0.6 | Vulnerable | BestWebSoft |
| cpe:2.3:a:bestwebsoft:promobar:*:*:*:*:*:wordpress:*:* | up to 1.1.0 | Vulnerable | BestWebSoft |
| cpe:2.3:a:bestwebsoft:quotes_and_tips:*:*:*:*:*:wordpress:*:* | up to 1.31 | Vulnerable | BestWebSoft |
| cpe:2.3:a:bestwebsoft:re-attacher:*:*:*:*:*:wordpress:*:* | up to 1.0.8 | Vulnerable | BestWebSoft |
| cpe:2.3:a:bestwebsoft:realty:*:*:*:*:*:wordpress:*:* | up to 1.0.9 | Vulnerable | BestWebSoft |
| cpe:2.3:a:bestwebsoft:relevant_-_related_posts:*:*:*:*:*:wordpress:*:* | up to 1.1.9 | Vulnerable | BestWebSoft |
| cpe:2.3:a:bestwebsoft:sender:*:*:*:*:*:wordpress:*:* | up to 1.2.0 | Vulnerable | BestWebSoft |
| cpe:2.3:a:bestwebsoft:smtp:*:*:*:*:*:wordpress:*:* | up to 1.0.9 | Vulnerable | BestWebSoft |
| cpe:2.3:a:bestwebsoft:social_buttons_pack:*:*:*:*:*:wordpress:*:* | up to 1.1.0 | Vulnerable | BestWebSoft |
| cpe:2.3:a:bestwebsoft:subscriber:*:*:*:*:*:wordpress:*:* | up to 1.3.4 | Vulnerable | BestWebSoft |
| cpe:2.3:a:bestwebsoft:testimonials:*:*:*:*:*:wordpress:*:* | up to 0.1.8 | Vulnerable | BestWebSoft |
| cpe:2.3:a:bestwebsoft:timesheet:*:*:*:*:*:wordpress:*:* | up to 0.1.4 | Vulnerable | BestWebSoft |
| cpe:2.3:a:bestwebsoft:twitter_button:*:*:*:*:*:wordpress:*:* | up to 2.54 | Vulnerable | BestWebSoft |
| cpe:2.3:a:bestwebsoft:updater:*:*:*:*:*:wordpress:*:* | up to 1.34 | Vulnerable | BestWebSoft |
| cpe:2.3:a:bestwebsoft:user_role:*:*:*:*:*:wordpress:*:* | up to 1.5.5 | Vulnerable | BestWebSoft |
| cpe:2.3:a:bestwebsoft:visitors_online:*:*:*:*:*:wordpress:*:* | up to 0.9 | Vulnerable | BestWebSoft |
| cpe:2.3:a:bestwebsoft:zendesk_help_center:*:*:*:*:*:wordpress:*:* | up to 1.0.4 | Vulnerable | BestWebSoft |
- cpe:2.3:a:bestwebsoft:error_log_viewer:*:*:*:*:*:wordpress:*:* Versions up to 1.0.5 Vulnerable ·BestWebSoft
- cpe:2.3:a:bestwebsoft:facebook_button:*:*:*:*:*:wordpress:*:* Versions up to 2.53 Vulnerable ·BestWebSoft
- cpe:2.3:a:bestwebsoft:featured_posts:*:*:*:*:*:wordpress:*:* Versions up to 1.0.0 Vulnerable ·BestWebSoft
- cpe:2.3:a:bestwebsoft:gallery:*:*:*:*:*:wordpress:*:* Versions up to 4.4.9 Vulnerable ·BestWebSoft
- cpe:2.3:a:bestwebsoft:gallery_categories:*:*:*:*:*:wordpress:*:* Versions up to 1.0.8 Vulnerable ·BestWebSoft
- cpe:2.3:a:bestwebsoft:google_\+1:*:*:*:*:*:wordpress:*:* Versions up to 1.3.3 Vulnerable ·BestWebSoft
- cpe:2.3:a:bestwebsoft:google_adsense:*:*:*:*:*:wordpress:*:* Versions up to 1.43 Vulnerable ·BestWebSoft
- cpe:2.3:a:bestwebsoft:google_analytics:*:*:*:*:*:wordpress:*:* Versions up to 1.7.0 Vulnerable ·BestWebSoft
- cpe:2.3:a:bestwebsoft:google_captcha_\(recaptcha\):*:*:*:*:*:wordpress:*:* Versions up to 1.27 Vulnerable ·BestWebSoft
- cpe:2.3:a:bestwebsoft:google_maps:*:*:*:*:*:wordpress:*:* Versions up to 1.3.5 Vulnerable ·BestWebSoft
- cpe:2.3:a:bestwebsoft:google_shortlink:*:*:*:*:*:wordpress:*:* Versions up to 1.5.2 Vulnerable ·BestWebSoft
- cpe:2.3:a:bestwebsoft:google_sitemap:*:*:*:*:*:wordpress:*:* Versions up to 3.0.7 Vulnerable ·BestWebSoft
- cpe:2.3:a:bestwebsoft:htaccess:*:*:*:*:*:wordpress:*:* Versions up to 1.7.5 Vulnerable ·BestWebSoft
- cpe:2.3:a:bestwebsoft:job_board:*:*:*:*:*:wordpress:*:* Versions up to 1.1.2 Vulnerable ·BestWebSoft
- cpe:2.3:a:bestwebsoft:latest_posts:*:*:*:*:*:wordpress:*:* Versions up to 0.2 Vulnerable ·BestWebSoft
- cpe:2.3:a:bestwebsoft:limit_attempts:*:*:*:*:*:wordpress:*:* Versions up to 1.1.7 Vulnerable ·BestWebSoft
- cpe:2.3:a:bestwebsoft:linkedin:*:*:*:*:*:wordpress:*:* Versions up to 1.0.4 Vulnerable ·BestWebSoft
- cpe:2.3:a:bestwebsoft:multilanguage:*:*:*:*:*:wordpress:*:* Versions up to 1.2.1 Vulnerable ·BestWebSoft
- cpe:2.3:a:bestwebsoft:pagination:*:*:*:*:*:wordpress:*:* Versions up to 1.0.6 Vulnerable ·BestWebSoft
- cpe:2.3:a:bestwebsoft:pdf_\&_print:*:*:*:*:*:wordpress:*:* Versions up to 1.9.3 Vulnerable ·BestWebSoft
- cpe:2.3:a:bestwebsoft:pinterest:*:*:*:*:*:wordpress:*:* Versions up to 1.0.4 Vulnerable ·BestWebSoft
- cpe:2.3:a:bestwebsoft:popular_posts:*:*:*:*:*:wordpress:*:* Versions up to 1.0.4 Vulnerable ·BestWebSoft
- cpe:2.3:a:bestwebsoft:portfolio:*:*:*:*:*:wordpress:*:* Versions up to 2.3 Vulnerable ·BestWebSoft
- cpe:2.3:a:bestwebsoft:post_to_csv:*:*:*:*:*:wordpress:*:* Versions up to 1.3.0 Vulnerable ·BestWebSoft
- cpe:2.3:a:bestwebsoft:profile_extra:*:*:*:*:*:wordpress:*:* Versions up to 1.0.6 Vulnerable ·BestWebSoft
- cpe:2.3:a:bestwebsoft:promobar:*:*:*:*:*:wordpress:*:* Versions up to 1.1.0 Vulnerable ·BestWebSoft
- cpe:2.3:a:bestwebsoft:quotes_and_tips:*:*:*:*:*:wordpress:*:* Versions up to 1.31 Vulnerable ·BestWebSoft
- cpe:2.3:a:bestwebsoft:re-attacher:*:*:*:*:*:wordpress:*:* Versions up to 1.0.8 Vulnerable ·BestWebSoft
- cpe:2.3:a:bestwebsoft:realty:*:*:*:*:*:wordpress:*:* Versions up to 1.0.9 Vulnerable ·BestWebSoft
- cpe:2.3:a:bestwebsoft:relevant_-_related_posts:*:*:*:*:*:wordpress:*:* Versions up to 1.1.9 Vulnerable ·BestWebSoft
- cpe:2.3:a:bestwebsoft:sender:*:*:*:*:*:wordpress:*:* Versions up to 1.2.0 Vulnerable ·BestWebSoft
- cpe:2.3:a:bestwebsoft:smtp:*:*:*:*:*:wordpress:*:* Versions up to 1.0.9 Vulnerable ·BestWebSoft
- cpe:2.3:a:bestwebsoft:social_buttons_pack:*:*:*:*:*:wordpress:*:* Versions up to 1.1.0 Vulnerable ·BestWebSoft
- cpe:2.3:a:bestwebsoft:subscriber:*:*:*:*:*:wordpress:*:* Versions up to 1.3.4 Vulnerable ·BestWebSoft
- cpe:2.3:a:bestwebsoft:testimonials:*:*:*:*:*:wordpress:*:* Versions up to 0.1.8 Vulnerable ·BestWebSoft
- cpe:2.3:a:bestwebsoft:timesheet:*:*:*:*:*:wordpress:*:* Versions up to 0.1.4 Vulnerable ·BestWebSoft
- cpe:2.3:a:bestwebsoft:twitter_button:*:*:*:*:*:wordpress:*:* Versions up to 2.54 Vulnerable ·BestWebSoft
- cpe:2.3:a:bestwebsoft:updater:*:*:*:*:*:wordpress:*:* Versions up to 1.34 Vulnerable ·BestWebSoft
- cpe:2.3:a:bestwebsoft:user_role:*:*:*:*:*:wordpress:*:* Versions up to 1.5.5 Vulnerable ·BestWebSoft
- cpe:2.3:a:bestwebsoft:visitors_online:*:*:*:*:*:wordpress:*:* Versions up to 0.9 Vulnerable ·BestWebSoft
- cpe:2.3:a:bestwebsoft:zendesk_help_center:*:*:*:*:*:wordpress:*:* Versions up to 1.0.4 Vulnerable ·BestWebSoft
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-2171
- 2026-10-03 Alias added: GHSA-947h-g3wj-rr28
References
Advisory 2
More BestWebSoft Captcha vulnerabilities
- TI-2023-24545 WordPress Contact Form With Captcha plugin <= 1.6.8 - Reflected Cross Site Scripting (XSS) vulnerability CVSS 3.1HIGH 7.1
- TI-2014-07538 The BestWebSoft Captcha plugin before 4.0.7 for WordPress allows remote attackers to… CVSS 2.0MEDIUM 5.0
Sources
- CVE-2017-2171 · CVE Program
- CVE-2017-2171 · NVD
- FIRST EPSS
- GHSA-947h-g3wj-rr28 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences