# cve.now: Bestwebsoft

The newest entries naming Bestwebsoft as an affected vendor (up to 200), of 33 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-39772](https://cve.now/CVE-2026-39772.md): WordPress Captcha by BestWebSoft plugin \<= 5.2.8 - Bypass Vulnerability vulnerability (CVSS 5.3)
- [CVE-2026-2497](https://cve.now/CVE-2026-2497.md): Gallery by BestWebSoft \<= 4.7.9 - Authenticated (Editor+) SQL Injection via Gallery Image Order Array Keys (CVSS 7.2)
- [CVE-2026-66456](https://cve.now/CVE-2026-66456.md): WordPress Profile Extra Fields by BestWebSoft plugin \<= 1.3.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-57642](https://cve.now/CVE-2026-57642.md): WordPress Gallery plugin \<= 4.7.8 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2026-24598](https://cve.now/CVE-2026-24598.md): WordPress Multilanguage by BestWebSoft plugin \<= 1.5.2 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2025-63056](https://cve.now/CVE-2025-63056.md): WordPress Contact Form by BestWebSoft plugin \<= 4.3.6 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2025-9950](https://cve.now/CVE-2025-9950.md): Error Log Viewer by BestWebSoft \<= 1.1.6 - Authenticated (Administrator+) Arbitrary File Read (CVSS 4.9)
- [CVE-2024-13906](https://cve.now/CVE-2024-13906.md): Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress \<= 4.7.3 - Authenticated (Administrator+) PHP Object Injection (CVSS 7.2)
- [CVE-2025-24628](https://cve.now/CVE-2025-24628.md): WordPress reCaptcha by BestWebSoft Plugin \<= 1.78 - Captcha Bypass vulnerability (CVSS 5.3)
- [CVE-2024-35678](https://cve.now/CVE-2024-35678.md): WordPress Contact Form to DB by BestWebSoft plugin \<= 1.7.2 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2024-31295](https://cve.now/CVE-2024-31295.md): WordPress Captcha by BestWebSoft plugin \<= 5.2.0 - Captcha Bypass vulnerability (CVSS 5.3)
- [CVE-2024-2198](https://cve.now/CVE-2024-2198.md): Contact Form by BestWebSoft \<= 4.2.8 - Reflected Cross-Site Scripting via cntctfrm\_contact\_address (CVSS 6.1)
- [CVE-2024-2200](https://cve.now/CVE-2024-2200.md): Contact Form by BestWebSoft \<= 4.2.8 - Reflected Cross-Site Scripting via cntctfrm\_contact\_subject (CVSS 6.1)
- [CVE-2024-30439](https://cve.now/CVE-2024-30439.md): WordPress Limit Attempts by BestWebSoft plugin \<= 1.2.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2014-125109](https://cve.now/CVE-2014-125109.md): BestWebSoft Portfolio Plugin bws\_menu.php bws\_add\_menu\_render cross site scripting (CVSS 3.5)
- [CVE-2012-10017](https://cve.now/CVE-2012-10017.md): BestWebSoft Portfolio Plugin cross-site request forgery (CVSS 4.3)
- [CVE-2023-29096](https://cve.now/CVE-2023-29096.md): WordPress Contact Form to DB by BestWebSoft Plugin \<= 1.7.0 is vulnerable to SQL Injection (CVSS 8.5)
- [CVE-2023-36527](https://cve.now/CVE-2023-36527.md): WordPress Post to CSV by BestWebSoft Plugin \<= 1.4.0 is vulnerable to CSV Injection (CVSS 4.7)
- [CVE-2023-36508](https://cve.now/CVE-2023-36508.md): WordPress Contact Form to DB by BestWebSoft Plugin \<= 1.7.1 is vulnerable to SQL Injection (CVSS 7.6)
- [CVE-2023-4469](https://cve.now/CVE-2023-4469.md): Profile Extra Fields by BestWebSoft \<= 1.2.7 - Missing Authorization to Sensitive Information Exposure (CVSS 5.3)
- [CVE-2023-28778](https://cve.now/CVE-2023-28778.md): WordPress Pagination by BestWebSoft Plugin \<= 1.2.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9)
- [CVE-2014-125103](https://cve.now/CVE-2014-125103.md): BestWebSoft Twitter Plugin twitter.php twttr\_settings\_page cross site scripting (CVSS 2.4)
- [CVE-2012-10015](https://cve.now/CVE-2012-10015.md): BestWebSoft Twitter Plugin Settings Page twitter.php twttr\_settings\_page cross-site request forgery (CVSS 4.3)
- [CVE-2014-125102](https://cve.now/CVE-2014-125102.md): Bestwebsoft Relevant Plugin Thumbnail information disclosure (CVSS 4.3)
- [CVE-2014-125100](https://cve.now/CVE-2014-125100.md): BestWebSoft Job Board Plugin cross site scripting (CVSS 3.5)
- [CVE-2022-44734](https://cve.now/CVE-2022-44734.md): WordPress Car Rental by BestWebSoft Plugin \<= 1.1.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 4.8)
- [CVE-2014-125097](https://cve.now/CVE-2014-125097.md): BestWebSoft Facebook Like Button facebook-button-plugin.php fcbkbttn\_settings\_page cross site scripting (CVSS 3.5)
- [CVE-2012-10012](https://cve.now/CVE-2012-10012.md): BestWebSoft Facebook Like Button facebook-button-plugin.php fcbk\_bttn\_plgn\_settings\_page cross-site request forgery (CVSS 4.3)
- [CVE-2014-125095](https://cve.now/CVE-2014-125095.md): BestWebSoft Contact Form Plugin bws\_menu.php bws\_add\_menu\_render cross site scripting (CVSS 3.5)
- [CVE-2012-10010](https://cve.now/CVE-2012-10010.md): BestWebSoft Contact Form contact\_form.php cntctfrm\_settings\_page cross-site request forgery (CVSS 4.3)
- [CVE-2013-10022](https://cve.now/CVE-2013-10022.md): BestWebSoft Contact Form Plugin contact\_form.php cntctfrm\_check\_form cross site scripting (CVSS 3.5)
- [CVE-2017-20055](https://cve.now/CVE-2017-20055.md): BestWebSoft Contact Form Plugin Stored cross site scriting (CVSS 3.5)
- [CVE-2017-2171](https://cve.now/CVE-2017-2171.md): Cross-site scripting vulnerability in Captcha prior to version 4.3.0, Car Rental prior to version 1.0.5, Contact Form Multi prior to version (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/bestwebsoft
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.