Contact Form To Db By Bestwebsoft
Monthly
Unauthenticated cross-site scripting in the WordPress plugin Contact Form to DB by BestWebSoft (versions 1.7.6 and earlier) lets remote attackers inject arbitrary client-side script through contact-form handling, which then executes in the browser of a victim who loads or views the crafted or stored content. Exploitation requires no credentials (the reported vector is PR:N) but does depend on victim interaction (UI:R) - typically an administrator opening submitted form data in the WordPress dashboard or a user following a crafted link - so impact is confined to the victim's browser session rather than direct server compromise. Patchstack rates the issue CVSS 3.1 7.1; our independent assessment keeps the same base characteristics except availability (A:N) and confirms the required user-interaction step as the main limiting factor. No public exploit code was identified at time of analysis and the flaw is not listed in CISA KEV.
Unauthenticated cross-site scripting in the WordPress plugin Contact Form to DB by BestWebSoft (versions 1.7.6 and earlier) lets remote attackers inject arbitrary client-side script through contact-form handling, which then executes in the browser of a victim who loads or views the crafted or stored content. Exploitation requires no credentials (the reported vector is PR:N) but does depend on victim interaction (UI:R) - typically an administrator opening submitted form data in the WordPress dashboard or a user following a crafted link - so impact is confined to the victim's browser session rather than direct server compromise. Patchstack rates the issue CVSS 3.1 7.1; our independent assessment keeps the same base characteristics except availability (A:N) and confirms the required user-interaction step as the main limiting factor. No public exploit code was identified at time of analysis and the flaw is not listed in CISA KEV.