CVE-2016-10869: Bestwebsoft contact form cross-site scripting vulnerability

Bestwebsoft · Contact Form

The contact-form-plugin plugin before 4.0.2 for WordPress has XSS.

6.1 CVSS 3.0 Medium EPSS 0.92% · top 41.2% CWE-79 · Cross-site scripting

6.1CVSS 3.0 base score, v2 4.3

0.92%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

2References

17 Jun 2026Last modified by NVD

Description

The contact-form-plugin plugin before 4.0.2 for WordPress has XSS.

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Contact Form Bestwebsoft

References

Link	Tags
https://wordpress.org/plugins/contact-form-plugin/#developers	Release NotesThird Party Advisory
https://wordpress.org/plugins/contact-form-plugin/#developers	Release NotesThird Party Advisory

Track CVE-2016-10869 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2012-10010Bestwebsoft contact form cross-site request forgery vulnerabilityA vulnerability was found in BestWebSoft Contact Form 3.21. It has been classified as problematic. This affects the function cntctfrm_settings_page o…EPSS 0.36%9 Apr 2023 6.1CVE-2024-2200Bestwebsoft contact form cross-site scripting vulnerabilityThe Contact Form by BestWebSoft plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘cntctfrm_contact_subject’ parameter in …EPSS 0.50%9 Apr 2024 6.1CVE-2014-125095Bestwebsoft contact form cross-site scripting vulnerabilityA vulnerability was found in BestWebSoft Contact Form Plugin 1.3.4 on WordPress and classified as problematic. Affected by this issue is the function…EPSS 0.55%9 Apr 2023 6.1CVE-2013-10022Bestwebsoft contact form cross-site scripting vulnerabilityA vulnerability, which was classified as problematic, has been found in BestWebSoft Contact Form Plugin 3.51 on WordPress. Affected by this issue is …EPSS 0.51%5 Apr 2023 6.1CVE-2013-7481Bestwebsoft contact form cross-site scripting vulnerabilityThe contact-form-plugin plugin before 3.3.5 for WordPress has XSS.EPSS 0.92%22 Aug 2019 6.1CVE-2017-18491Bestwebsoft contact form cross-site scripting vulnerabilityThe contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues.EPSS 1.5%13 Aug 2019 6.1CVE-2013-7475Bestwebsoft contact form cross-site scripting vulnerabilityThe contact-form-plugin plugin before 3.52 for WordPress has XSS.EPSS 0.92%13 Aug 2019 6.1CVE-2015-9295Bestwebsoft contact form cross-site scripting vulnerabilityThe contact-form-plugin plugin before 3.96 for WordPress has XSS.EPSS 0.92%13 Aug 2019

Source: NIST National Vulnerability Database (record CVE-2016-10869), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.