Vulnerability record · CVE-2014-125095 · published 9 April 2023

CVE-2014-125095: Bestwebsoft contact form cross-site scripting vulnerability

Bestwebsoft · Contact Form

A vulnerability was found in BestWebSoft Contact Form Plugin 1.3.4 on WordPress and classified as problematic. Affected by this issue is the function bws_add_menu_render of the file bws_menu/bws_menu.php. The manipulation of the argument bwsmn_form_email leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.3.7 is able to address this issue. The name of the patch is 4d531f74b4a801c805dc80360d4ea1312e9a278f. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-225320.

6.1 CVSS 3.1 Medium EPSS 0.55% · top 56.4% CWE-79 · Cross-site scripting

6.1CVSS 3.1 base score, v2 4.0

0.55%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

6References

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Contact Form Bestwebsoft

References

Link	Tags
https://github.com/wp-plugins/contact-form-plugin/commit/4d531f74b4a801c805dc80360d4ea1312e9a278f	Patch
https://vuldb.com/?ctiid.225320	Permissions RequiredThird Party Advisory
https://vuldb.com/?id.225320	Third Party Advisory
https://github.com/wp-plugins/contact-form-plugin/commit/4d531f74b4a801c805dc80360d4ea1312e9a278f	Patch
https://vuldb.com/?ctiid.225320	Permissions RequiredThird Party Advisory
https://vuldb.com/?id.225320	Third Party Advisory

Track CVE-2014-125095 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2012-10010Bestwebsoft contact form cross-site request forgery vulnerabilityA vulnerability was found in BestWebSoft Contact Form 3.21. It has been classified as problematic. This affects the function cntctfrm_settings_page o…EPSS 0.36%9 Apr 2023 6.1CVE-2024-2200Bestwebsoft contact form cross-site scripting vulnerabilityThe Contact Form by BestWebSoft plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘cntctfrm_contact_subject’ parameter in …EPSS 0.50%9 Apr 2024 6.1CVE-2013-10022Bestwebsoft contact form cross-site scripting vulnerabilityA vulnerability, which was classified as problematic, has been found in BestWebSoft Contact Form Plugin 3.51 on WordPress. Affected by this issue is …EPSS 0.51%5 Apr 2023 6.1CVE-2013-7481Bestwebsoft contact form cross-site scripting vulnerabilityThe contact-form-plugin plugin before 3.3.5 for WordPress has XSS.EPSS 0.92%22 Aug 2019 6.1CVE-2017-18491Bestwebsoft contact form cross-site scripting vulnerabilityThe contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues.EPSS 1.5%13 Aug 2019 6.1CVE-2016-10869Bestwebsoft contact form cross-site scripting vulnerabilityThe contact-form-plugin plugin before 4.0.2 for WordPress has XSS.EPSS 0.92%13 Aug 2019 6.1CVE-2013-7475Bestwebsoft contact form cross-site scripting vulnerabilityThe contact-form-plugin plugin before 3.52 for WordPress has XSS.EPSS 0.92%13 Aug 2019 6.1CVE-2015-9295Bestwebsoft contact form cross-site scripting vulnerabilityThe contact-form-plugin plugin before 3.96 for WordPress has XSS.EPSS 0.92%13 Aug 2019

Source: NIST National Vulnerability Database (record CVE-2014-125095), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.