bestweblayout
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| Columns by BestWebSoft – Additional Columns Plugin for Posts Pages and Widgets | 1 | – | Apr 8, 2026 |
| Contact Form to DB by BestWebSoft | 1 | – | Oct 6, 2026 |
| Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress | 1 | – | Sep 9, 2026 |
| Job Board by BestWebSoft | 1 | – | Nov 25, 2025 |
| Portfolio | 1 | – | Sep 22, 2025 |
| Rating by BestWebSoft | 1 | – | Apr 17, 2025 |
| Realty by BestWebSoft | 1 | – | Nov 9, 2024 |
| Slider by BestWebSoft | 1 | – | Mar 28, 2025 |
| SMTP by BestWebSoft | 1 | – | Mar 8, 2025 |
Exploited and recent CVEs
- CVE-2026-39745 WordPress Contact Form to DB by BestWebSoft plugin <= 1.7.6 - Cross Site Scripting (XSS) vulnerability 0.2%
- CVE-2026-13359 Contact Form to DB by BestWebSoft <= 1.7.5 - Unauthenticated Stored Cross-Site Scripting via cntctfrm_contact_dropdown Parameter 0.4%
- CVE-2026-3618 Columns by BestWebSoft <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'columns' Shortcode 'id' Attribute 0.3%
- CVE-2025-13383 Job Board by BestWebSoft <= 1.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via $_GET Array Storage 0.3%
- CVE-2025-58245 WordPress Portfolio Plugin <= 2.58 - Cross Site Scripting (XSS) Vulnerability 0.2%
- CVE-2025-39527 WordPress Rating by BestWebSoft plugin <= 1.7 - PHP Object Injection Vulnerability 0.5%
- CVE-2025-31099 WordPress Slider by BestWebSoft plugin <= 1.1.0 - SQL Injection Vulnerability 0.3%
- CVE-2024-13908 SMTP by BestWebSoft <= 1.1.9 - Authenticated (Administrator+) Arbitrary File Upload 0.8%
- CVE-2024-51786 WordPress Realty by BestWebSoft plugin <= 1.1.5 - Cross Site Scripting (XSS) vulnerability 0.3%