Skip to content
OpenAdvisories

Vendor

bestweblayout

9 known vulnerabilities.

Products

Job Board by BestWebSoft 1 Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress 1 Rating by BestWebSoft 1 Slider by BestWebSoft 1 Columns by BestWebSoft – Additional Columns Plugin for Posts Pages and Widgets 1 Portfolio 1 Realty by BestWebSoft 1 Contact Form to DB by BestWebSoft 1 SMTP by BestWebSoft 1
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • High 7.1
    CVE-2026-39745

    WordPress Contact Form to DB by BestWebSoft plugin <= 1.7.6 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Contact Form to DB by BestWebSoft <= 1.7.6 versions.

    bestweblayout Contact Form to DB by BestWebSoft
  • High 7.2
    CVE-2026-13359

    Contact Form to DB by BestWebSoft <= 1.7.5 - Unauthenticated Stored Cross-Site Scripting via cntctfrm_contact_dropdown Parameter

    The Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cntctfrm_contact_dropdown Parameter in all versions up to, and including, 1.7.5 due to insufficient input sani…

    bestweblayout Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress Web / CMS
  • High 8.8
    CVE-2025-39527

    WordPress Rating by BestWebSoft plugin <= 1.7 - PHP Object Injection Vulnerability

    Deserialization of Untrusted Data vulnerability in bestweblayout Rating by BestWebSoft rating-bws allows Object Injection.This issue affects Rating by BestWebSoft: from n/a through <= 1.7.

    bestweblayout Rating by BestWebSoft
  • High 7.6
    CVE-2025-31099

    WordPress Slider by BestWebSoft plugin <= 1.1.0 - SQL Injection Vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bestweblayout Slider by BestWebSoft slider-bws allows SQL Injection.This issue affects Slider by BestWebSoft: from n/a through <= 1.1.0.

    bestweblayout Slider by BestWebSoft
  • High 7.2
    CVE-2024-13908

    SMTP by BestWebSoft <= 1.1.9 - Authenticated (Administrator+) Arbitrary File Upload

    The SMTP by BestWebSoft plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_options' function in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with Admin…

    bestweblayout SMTP by BestWebSoft Web / CMS