Bestwebsoft User Role vulnerabilities

3 CVEs affecting Bestwebsoft User Role, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-0820, published 2023-04-03.

More from Bestwebsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2017-18566, published 2019-08-20. Medium severity, CVSS 6.1. EPSS: 1.4% chance of exploitation in the next 30 days. The user-role plugin before 1.5.6 for WordPress has multiple XSS issues.
• CVE-2017-2171, published 2017-05-22. Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days. Cross-site scripting vulnerability in Captcha prior to version 4.3.0, Car Rental prior to version 1.0.5, Contact Form Multi prior to version 1.2.1, Contact Form prior to version 4.0.6, Contact Form…
• CVE-2023-0820, published 2023-04-03. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. The User Role by BestWebSoft WordPress plugin before 1.6.7 does not protect against CSRF in requests to update role capabilities, leading to arbitrary privilege escalation of any role.