Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2016-10869: bestwebsoft contact_form plugin can run malicious code

CVE-2016-10869 · published 7 years ago

Summary

The Contact Form plugin for WordPress (versions before 4.0.2) allows attackers to inject harmful scripts into pages. This could let a bad actor display fake messages or steal information from visitors. Update the plugin to version 4.0.2 or later, or remove it if you cannot apply the update.

What to do

Update bestwebsoft contact_form to version 4.0.2 or later.

Affected software

Vendor	Product	Affected versions
bestwebsoft	contact_form	< 4.0.2 `cpe:2.3:a:bestwebsoft:contact_form::::::wordpress::*`

Original advisory text

The contact-form-plugin plugin before 4.0.2 for WordPress has XSS.

References

https://wordpress.org/plugins/contact-form-plugin/#developers Release Notes Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.1 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published13 Aug 2019

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2016-10869 · NVD

Track software like this

Free during beta