CVE-2017-18492
published 2019-08-13CVE-2017-18492: The contact-form-to-db plugin before 1.5.7 for WordPress has multiple XSS issues.
PriorityP434medium6.1CVSS 3.0
AVNACLPRNUIRSCCLILAN
EXPLOIT
EPSS
1.46%
70.3th percentile
The contact-form-to-db plugin before 1.5.7 for WordPress has multiple XSS issues.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| bestwebsoft | contact_form_to_db | < 1.5.7 | 1.5.7 |
CVSS provenance
nvdv3.06.1MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Nuclei
Contact Form to DB by BestWebSoft < 1.5.7 - Cross-Site Scripting
nuclei·CVSS 6.1
CVE-2017-18492 [MEDIUM] Contact Form to DB by BestWebSoft < 1.5.7 - Cross-Site Scripting
Contact Form to DB by BestWebSoft alert(document.domain)\">All")'
- 'contains(body_3, "Contact Form to DB by")'
condition: and
# digest: 4b0a00483046022100f42f18eecb7f29e39fd1961ff82752a0d6dd2f416ca22042cb556ee80bf11e61022100f8e0181e37f286c5796b3b7bbd7573a32179acf65110520429f4612105b7ede9:922c64590222798bb761d5b6d8e72950
No writeups or analysis indexed.
2019-08-13
Published