Vulnerabilities

TI-2026-67944 CVE-2026-39745 · GHSA-3r82-vx58-5wrc

Cross-site scripting in Contact Form to DB by BestWebSoft plugin

LOW 31

Unauthenticated Cross Site Scripting (XSS) in Contact Form to DB by BestWebSoft <= 1.7.6 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.0023 Published 2026-10-06 No fix listed CWE-79

TI-2026-11320 CVE-2026-13359 · GHSA-wc2g-rq32-7mv5

Cross-site scripting in bestweblayout Contact Form to DB by BestWebSoft – Messages…

LOW 38

The Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cntctfrm_contact_dropdown Parameter in all versions up to, and includin…

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00405 Published 2026-09-09 No fix listed CWE-79

TI-2026-03121 CVE-2026-3618 · GHSA-5xc8-cv7x-vq3g

Cross-site scripting in bestweblayout Columns by BestWebSoft – Additional Columns Plugin…

LOW 28

The Columns by BestWebSoft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode attribute of the [print_clmns] shortcode in all versions up to and including 1.0.3.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00314 Published 2026-04-08 No fix listed CWE-79

TI-2025-12235 CVE-2025-13383 · GHSA-pfvf-x75c-fh64

Job Board by BestWebSoft <= 1.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via $_GET Array Storage

LOW 27

The Job Board by BestWebSoft plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.2.1.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00275 Published 2025-11-25 No fix listed CWE-79

TI-2025-36050 CVE-2025-58245 · GHSA-4vgh-hg4g-v8g9

WordPress Portfolio Plugin <= 2.58 - Cross Site Scripting (XSS) Vulnerability

LOW 26

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bestweblayout Portfolio portfolio allows DOM-Based XSS.This issue affects Portfolio : from n/a through <= 2.58.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00225 Published 2025-09-22 No fix listed CWE-79

TI-2025-26269 CVE-2025-39527 · GHSA-wwj8-vw56-c53c

WordPress Rating by BestWebSoft plugin <= 1.7 - PHP Object Injection Vulnerability

MEDIUM 41

Deserialization of Untrusted Data vulnerability in bestweblayout Rating by BestWebSoft rating-bws allows Object Injection.This issue affects Rating by BestWebSoft: from n/a through <= 1.7.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00489 Published 2025-04-17 No fix listed CWE-502

TI-2025-22369 CVE-2025-31099 · GHSA-x46r-qvwm-8m8h

WordPress Slider by BestWebSoft plugin <= 1.1.0 - SQL Injection Vulnerability

LOW 33

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bestweblayout Slider by BestWebSoft slider-bws allows SQL Injection.This issue affects Slider by BestWebSoft: from n/a…

CVSS 3.1HIGH 7.6 Network High privileges No interaction EPSS 0.00345 Published 2025-03-28 No fix listed CWE-89

TI-2024-34690 CVE-2024-51786 · GHSA-6wh9-5xqw-j4hc

WordPress Realty by BestWebSoft plugin <= 1.1.5 - Cross Site Scripting (XSS) vulnerability

LOW 28

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bestweblayout Realty by BestWebSoft realty allows Stored XSS.This issue affects Realty by BestWebSoft: from n/a throug…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00268 Published 2024-11-09 No fix listed CWE-79

Vulnerabilities

Filters