CVE-2017-18491 Contact Form by BestWebSoft < 4.0.6 - Cross-Site Scripting · CloudMap

中危CVE-2017-18491

Contact Form by BestWebSoft < 4.0.6 - Cross-Site Scripting

披露于 2019/08/13 · 更新于 2025/10/30

CVSS 评分6.1/ 10.0

EPSS 概率0.10%百分位 29.4%

漏洞描述

The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues.

建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。

RELATED INTELLIGENCE

与 contact_form 相关的其他公开漏洞。

漏洞与影响对象	风险等级	CVSS	EPSS	利用情报	披露时间
CVE-2026-4257 WordPress Contact Form by Supsystic - Server-Side Template Injection contact_form	严重	—	—	PoCEXP	2026/06/25
wp_contact_form_fpd WordPress Contact Form - Full Path Disclosure contact-form-7 contact-form-7-signature-addon contact-form-7-style+11	低危	—	—	PoCEXP	2026/01/14
CVE-2024-2771RCE Contact Form Plugin by Fluent Forms < 5.1.17 - Unauthenticated Limited Privilege Escalation contact_form	严重	9.8	—	PoCEXP	2025/10/04
CVE-2024-2782 WordPress FluentForms <= 5.1.16 - Broken Access Control contact_form	高危	7.5	—	PoCEXP	2025/10/04
CVE-2021-24276 WordPress Supsystic Contact Form <1.7.15 - Cross-Site Scripting contact_form	中危	6.1	8.4%	PoCEXP	2021/05/06