CVE-2017-2171 — Cross-site scripting vulnerability in Captcha prior to version 4.3.0, Car Rental prior to version 1.0.5, Contact Form Multi prior to version 1.2.1, Contact Form prior to version 4.0.6, Contact Form to DB prior to version 1.5.7, Custom Admin Page prior to version 0.1.2, Custom Fields Search prior to version 1.3.2, Custom Search prior to version 1.36, Donate prior to version 2.1.1, Email Queue prior to version 1.1.2, Error Log Viewer prior to version 1.0.6, Facebook Button prior to version 2.54, Featured Posts prior to version 1.0.1, Gallery Categories prior to version 1.0.9, Gallery prior to version 4.5.0, Google +1 prior to version 1.3.4, Google AdSense prior to version 1.44, Google Analytics prior to version 1.7.1, Google Captcha (reCAPTCHA) prior to version 1.28, Google Maps prior to version 1.3.6, Google Shortlink prior to version 1.5.3, Google Sitemap prior to version 3.0.8, Htaccess prior to version 1.7.6, Job Board prior to version 1.1.3, Latest Posts prior to version 0.3, Limit Attempts prior to version 1.1.8, LinkedIn prior to version 1.0.5, Multilanguage prior to version 1.2.2, PDF & Print prior to version 1.9.4, Pagination prior to version 1.0.7, Pinterest prior to version 1.0.5, Popular Posts prior to version 1.0.5, Portfolio prior to version 2.4, Post to CSV prior to version 1.3.1, Profile Extra prior to version 1.0.7

Back Back to CVE browser

MEDIUM

Cross-site scripting vulnerability in Captcha prior to version 4.3.0, Car Rental prior to version 1.0.5, Contact Form Multi prior to version 1.2.1, Contact Form prior to version 4.0.6, Contact Form to DB prior to version 1.5.7, Custom Admin Page prior to version 0.1.2, Custom Fields Search prior to version 1.3.2, Custom Search prior to version 1.36, Donate prior to version 2.1.1, Email Queue prior to version 1.1.2, Error Log Viewer prior to version 1.0.6, Facebook Button prior to version 2.54, Featured Posts prior to version 1.0.1, Gallery Categories prior to version 1.0.9, Gallery prior to version 4.5.0, Google +1 prior to version 1.3.4, Google AdSense prior to version 1.44, Google Analytics prior to version 1.7.1, Google Captcha (reCAPTCHA) prior to version 1.28, Google Maps prior to version 1.3.6, Google Shortlink prior to version 1.5.3, Google Sitemap prior to version 3.0.8, Htaccess prior to version 1.7.6, Job Board prior to version 1.1.3, Latest Posts prior to version 0.3, Limit Attempts prior to version 1.1.8, LinkedIn prior to version 1.0.5, Multilanguage prior to version 1.2.2, PDF & Print prior to version 1.9.4, Pagination prior to version 1.0.7, Pinterest prior to version 1.0.5, Popular Posts prior to version 1.0.5, Portfolio prior to version 2.4, Post to CSV prior to version 1.3.1, Profile Extra prior to version 1.0.7

Published May 22, 2017

6.1

MEDIUM

CVSS 3.0

EPSS 0.89%

Description

Cross-site scripting vulnerability in Captcha prior to version 4.3.0, Car Rental prior to version 1.0.5, Contact Form Multi prior to version 1.2.1, Contact Form prior to version 4.0.6, Contact Form to DB prior to version 1.5.7, Custom Admin Page prior to version 0.1.2, Custom Fields Search prior to version 1.3.2, Custom Search prior to version 1.36, Donate prior to version 2.1.1, Email Queue prior to version 1.1.2, Error Log Viewer prior to version 1.0.6, Facebook Button prior to version 2.54, Featured Posts prior to version 1.0.1, Gallery Categories prior to version 1.0.9, Gallery prior to version 4.5.0, Google +1 prior to version 1.3.4, Google AdSense prior to version 1.44, Google Analytics prior to version 1.7.1, Google Captcha (reCAPTCHA) prior to version 1.28, Google Maps prior to version 1.3.6, Google Shortlink prior to version 1.5.3, Google Sitemap prior to version 3.0.8, Htaccess prior to version 1.7.6, Job Board prior to version 1.1.3, Latest Posts prior to version 0.3, Limit Attempts prior to version 1.1.8, LinkedIn prior to version 1.0.5, Multilanguage prior to version 1.2.2, PDF & Print prior to version 1.9.4, Pagination prior to version 1.0.7, Pinterest prior to version 1.0.5, Popular Posts prior to version 1.0.5, Portfolio prior to version 2.4, Post to CSV prior to version 1.3.1, Profile Extra prior to version 1.0.7. PromoBar prior to version 1.1.1, Quotes and Tips prior to version 1.32, Re-attacher prior to version 1.0.9, Realty prior to version 1.1.0, Relevant - Related Posts prior to version 1.2.0, Sender prior to version 1.2.1, SMTP prior to version 1.1.0, Social Buttons Pack prior to version 1.1.1, Subscriber prior to version 1.3.5, Testimonials prior to version 0.1.9, Timesheet prior to version 0.1.5, Twitter Button prior to version 2.55, User Role prior to version 1.5.6, Updater prior to version 1.35, Visitors Online prior to version 1.0.0, and Zendesk Help Center prior to version 1.0.5 allows remote attackers to inject arbitrary web script or HTML via the function to display the BestWebSoft menu.

Affected products

Vendor BestWebSoft Product Captcha Default
n/a
- Version
  prior to version 4.3.0
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product Car Rental Default
n/a
- Version
  prior to version 1.0.5
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product Contact Form Default
n/a
- Version
  prior to version 4.0.6
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product Contact Form Multi Default
n/a
- Version
  prior to version 1.2.1
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product Contact Form to DB Default
n/a
- Version
  prior to version 1.5.7
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product Custom Admin Page Default
n/a
- Version
  prior to version 0.1.2
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product Custom Fields Search Default
n/a
- Version
  prior to version 1.3.2
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product Custom Search Default
n/a
- Version
  prior to version 1.36
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product Donate Default
n/a
- Version
  prior to version 2.1.1
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product Email Queue Default
n/a
- Version
  prior to version 1.1.2
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product Error Log Viewer Default
n/a
- Version
  prior to version 1.0.6
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product Facebook Button Default
n/a
- Version
  prior to version 2.54
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product Featured Posts Default
n/a
- Version
  prior to version 1.0.1
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product Gallery Default
n/a
- Version
  prior to version 4.5.0
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product Gallery Categories Default
n/a
- Version
  prior to version 1.0.9
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product Google +1 Default
n/a
- Version
  prior to version 1.3.4
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product Google AdSense Default
n/a
- Version
  prior to version 1.44
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product Google Analytics Default
n/a
- Version
  prior to version 1.7.1
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product Google Captcha (reCAPTCHA) Default
n/a
- Version
  prior to version 1.28
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product Google Maps Default
n/a
- Version
  prior to version 1.3.6
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product Google Shortlink Default
n/a
- Version
  prior to version 1.5.3
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product Google Sitemap Default
n/a
- Version
  prior to version 3.0.8
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product Htaccess Default
n/a
- Version
  prior to version 1.7.6
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product Job Board Default
n/a
- Version
  prior to version 1.1.3
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product Latest Posts Default
n/a
- Version
  prior to version 0.3
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product Limit Attempts Default
n/a
- Version
  prior to version 1.1.8
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product LinkedIn Default
n/a
- Version
  prior to version 1.0.5
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product Multilanguage Default
n/a
- Version
  prior to version 1.2.2
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product PDF & Print Default
n/a
- Version
  prior to version 1.9.4
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product Pagination Default
n/a
- Version
  prior to version 1.0.7
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product Pinterest Default
n/a
- Version
  prior to version 1.0.5
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product Popular Posts Default
n/a
- Version
  prior to version 1.0.5
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product Portfolio Default
n/a
- Version
  prior to version 2.4
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product Post to CSV Default
n/a
- Version
  prior to version 1.3.1
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product Profile Extra Default
n/a
- Version
  prior to version 1.0.7
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product PromoBar Default
n/a
- Version
  prior to version 1.1.1
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product Quotes and Tips Default
n/a
- Version
  prior to version 1.32
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product Re-attacher Default
n/a
- Version
  prior to version 1.0.9
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product Realty Default
n/a
- Version
  prior to version 1.1.0
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product Relevant - Related Posts Default
n/a
- Version
  prior to version 1.2.0
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product SMTP Default
n/a
- Version
  prior to version 1.1.0
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product Sender Default
n/a
- Version
  prior to version 1.2.1
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product Social Buttons Pack Default
n/a
- Version
  prior to version 1.1.1
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product Subscriber Default
n/a
- Version
  prior to version 1.3.5
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product Testimonials Default
n/a
- Version
  prior to version 0.1.9
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product Timesheet Default
n/a
- Version
  prior to version 0.1.5
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product Twitter Button Default
n/a
- Version
  prior to version 2.55
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product Updater Default
n/a
- Version
  prior to version 1.35
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product User Role Default
n/a
- Version
  prior to version 1.5.6
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product Visitors Online Default
n/a
- Version
  prior to version 1.0.0
  Status
  affected
  Constraints
  -
Vendor BestWebSoft Product Zendesk Help Center Default
n/a
- Version
  prior to version 1.0.5
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

BestWebSoft

Captcha

n/a

Version	Status	Constraints
prior to version 4.3.0	affected	-

BestWebSoft

Car Rental

n/a

Version	Status	Constraints
prior to version 1.0.5	affected	-

BestWebSoft

Contact Form

n/a

Version	Status	Constraints
prior to version 4.0.6	affected	-

BestWebSoft

Contact Form Multi

n/a

Version	Status	Constraints
prior to version 1.2.1	affected	-

BestWebSoft

Contact Form to DB

n/a

Version	Status	Constraints
prior to version 1.5.7	affected	-

BestWebSoft

Custom Admin Page

n/a

Version	Status	Constraints
prior to version 0.1.2	affected	-

BestWebSoft

Custom Fields Search

n/a

Version	Status	Constraints
prior to version 1.3.2	affected	-

BestWebSoft

Custom Search

n/a

Version	Status	Constraints
prior to version 1.36	affected	-

BestWebSoft

Donate

n/a

Version	Status	Constraints
prior to version 2.1.1	affected	-

BestWebSoft

Email Queue

n/a

Version	Status	Constraints
prior to version 1.1.2	affected	-

BestWebSoft

Error Log Viewer

n/a

Version	Status	Constraints
prior to version 1.0.6	affected	-

BestWebSoft

Facebook Button

n/a

Version	Status	Constraints
prior to version 2.54	affected	-

BestWebSoft

Remediation

No remediation recorded yet.

Metrics

0.89% 0.00886

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00886

Score over time

2021–2026

EPSS v1
EPSS v5
EPSS v2
EPSS v3

Percentile over time

EPSS v1
EPSS v5
EPSS v2
EPSS v3

Table of values (9 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.89% (0.00886)	57.79th	v5 (v2026.06.15)
Sep 20, 2026	0.89% (0.00886)	57.71th	v5 (v2026.06.15)
Jul 20, 2024	0.07% (0.00071)	31.35th	v3 (v2023.03.01)
May 22, 2024	0.07% (0.00071)	30.59th	v3 (v2023.03.01)
Mar 7, 2023	0.07% (0.00070)	28.57th	v3 (v2023.03.01)
Mar 6, 2023	1.05% (0.01055)	52.13th	v2 (v2022.01.01)
Feb 4, 2022	1.05% (0.01055)	27.52th	v2 (v2022.01.01)
Feb 3, 2022	0.83% (0.00833)	24.94th	v5 (v2026.06.15)
Apr 14, 2021	0.83% (0.00833)	0.00th	v1

Weaknesses (2)

CWE-79

Cross-site Scripting (XSS)

CWE-91

References (2)

http://jvndb.jvn.jp/jvndb/JVNDB-2017-000094
third-party-advisoryx_refsource_JVNDBThird Party AdvisoryVDB Entry
https://jvn.jp/en/jp/JVN24834813/index.html
third-party-advisoryx_refsource_JVNThird Party AdvisoryVDB Entry

Link	Providers	Tags
http://jvndb.jvn.jp/jvndb/JVNDB-2017-000094		third-party-advisoryx_refsource_JVNDBThird Party AdvisoryVDB Entry
https://jvn.jp/en/jp/JVN24834813/index.html		third-party-advisoryx_refsource_JVNThird Party AdvisoryVDB Entry