bestwebsoft htaccess vulnerabilities

Latest bestwebsoft htaccess CVEs

Newest publication first

1. CVE-2020-8658 Htaccess <= 1.8.1 - Cross-Site Request Forgery

   Published 2020-02-06

   High·CVSS 8.8 EPSS 9.9%

   The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccess_editor CSRF. The flag htccss_nonce_name passes the nonce to WordPress but the plugin does not validate it correctly, resulting in a wrong implementation of anti...

2. CVE-2017-18496 Htaccess by BestWebSoft – WordPress Website Access Control Plugin <= 1.7.5 - Reflected Cross-Site Scripting

   Published 2019-08-13

   Medium·CVSS 6.1 EPSS 1.4%

   The htaccess plugin before 1.7.6 for WordPress has multiple XSS issues.

3. CVE-2017-2171 Cross-site scripting vulnerability in Captcha prior to version 4.3.0, Car Rental prior to version 1.0.5, Contact Form Multi prior to version 1.2.1, Contact Form prior to version 4.0.6, Contact Form to...

   Published 2017-05-22

   Medium·CVSS 6.1 EPSS 0.89%

   Cross-site scripting vulnerability in Captcha prior to version 4.3.0, Car Rental prior to version 1.0.5, Contact Form Multi prior to version 1.2.1, Contact Form prior to version 4.0.6, Contact Form to DB prior to version 1.5.7, Custom Admin Page prior to version 0.1.2, Custom Fie...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.