CVE-2024-2200

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Contact Form by BestWebSoft plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘cntctfrm_contact_subject’ parameter in all versions up to, and including, 4.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Apr 9, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-220027.8CORSAIR iCUE 5.9.105 with iCUE Murals on Windows allows unprivileged users to insert DLL files in the cuepkg-1.2.6 subdirectory of the insta CVE-2024-220047.7Due to length check, an attacker with privilege access on a Linux Nonsecure operating system can trigger a vulnerability and leak the secure CVE-2024-220058.4there is a possible Authentication Bypass due to improperly used crypto. This could lead to local escalation of privilege with no additional CVE-2024-220065.3OOB read in the TMU plugin that allows for memory disclosure in the power management subsystem of the device.CVE-2024-220076.2In constraint_check of fvp.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information dis CVE-2024-220087.8In config_gov_time_windows of tmu.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalat CVE-2024-220097.1In init_data of , there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege wi CVE-2024-22014.7A cross-privilege Spectre v2 vulnerability allows attackers to bypass all deployed mitigations, including the recent Fine(IBT), and to leak CVE-2024-220105.5In dvfs_plugin_caller of fvp.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information d CVE-2024-220117.5In ss_ProcessRejectComponent of ss_MmConManagement.c, there is a possible out of bounds read due to a missing bounds check. This could lead CVE-2024-220127.8there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional e CVE-2024-220135.3U-Boot environment is read from unauthenticated partition.