CVE-2017-2171 [Medium] | XSS in Captcha

Cross-site scripting vulnerability in Captcha prior to version 4.3.0, Car Rental prior to version 1.0.5, Contact Form Multi prior to version 1.2.1, Contact Form prior to version 4.0.6, Contact Form to DB prior to version 1.5.7, Custom Admin Page prior to version 0.1.2, Custom Fields Search prior to version 1.3.2, Custom Search prior to version 1.36, Donate prior to version 2.1.1, Email Queue prior to version 1.1.2, Error Log Viewer prior to version 1.0.6, Facebook Button prior to version 2.54, Featured Posts prior to version 1.0.1, Gallery Categories prior to version 1.0.9, Gallery prior to version 4.5.0, Google +1 prior to version 1.3.4, Google AdSense prior to version 1.44, Google Analytics prior to version 1.7.1, Google Captcha (reCAPTCHA) prior to version 1.28, Google Maps prior to version 1.3.6, Google Shortlink prior to version 1.5.3, Google Sitemap prior to version 3.0.8, Htaccess prior to version 1.7.6, Job Board prior to version 1.1.3, Latest Posts prior to version 0.3, Limit Attempts prior to version 1.1.8, LinkedIn prior to version 1.0.5, Multilanguage prior to version 1.2.2, PDF & Print prior to version 1.9.4, Pagination prior to version 1.0.7, Pinterest prior to version 1.0.5, Popular Posts prior to version 1.0.5, Portfolio prior to version 2.4, Post to CSV prior to version 1.3.1, Profile Extra prior to version 1.0.7. PromoBar prior to version 1.1.1, Quotes and Tips prior to version 1.32, Re-attacher prior to version 1.0.9, Realty prior to version 1.1.0, Relevant - Related Posts prior to version 1.2.0, Sender prior to version 1.2.1, SMTP prior to version 1.1.0, Social Buttons Pack prior to version 1.1.1, Subscriber prior to version 1.3.5, Testimonials prior to version 0.1.9, Timesheet prior to version 0.1.5, Twitter Button prior to version 2.55, User Role prior to version 1.5.6, Updater prior to version 1.35, Visitors Online prior to version 1.0.0, and Zendesk Help Center prior to version 1.0.5 allows remote attackers to inject arbitrary web script or HTML via the function to display the BestWebSoft menu.

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2025-03-17	0.07%	0.23%	+0.16%
2	2023-03-07	1.05%	0.07%	-0.99%
3	2022-02-04	—	1.05%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2025-03-17

0.07%

0.23%

+0.16%

2023-03-07

1.05%

0.07%

-0.99%

2022-02-04

—

1.05%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
6.1	3.0	MEDIUM	`CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:N) No account or special rights needed—anonymous or random user is enough. User interaction (UI:R) A real person has to do something—click, install, enable—otherwise it doesn’t land. Scope (S:C) Breaking this can reach past the original component and bite other resources—bigger blast radius. Confidentiality (C:L) Some sensitive info could get out, but not a total data dump. Integrity (I:L) Attackers could change some data, but it’s limited—not everything goes. Availability (A:N) Service keeps running; no real outage angle.	2.8	2.7	[email protected]
4.3	2.0	MEDIUM	`AV:N/AC:M/Au:N/C:N/I:P/A:N` Click to expand Access vector (AV:N) Can be exploited remotely over network reachability. Access complexity (AC:M) Exploitation needs some favorable conditions, but not exceptional ones. Authentication (AU:N) No authentication is required. Confidentiality impact (C:N) No confidentiality impact. Integrity impact (I:P) Partial integrity impact. Availability impact (A:N) No availability impact.	8.6	2.9	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

6.1

3.0

MEDIUM

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Click to expand

Attack vector (AV:N): Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N): No account or special rights needed—anonymous or random user is enough.
User interaction (UI:R): A real person has to do something—click, install, enable—otherwise it doesn’t land.
Scope (S:C): Breaking this can reach past the original component and bite other resources—bigger blast radius.
Confidentiality (C:L): Some sensitive info could get out, but not a total data dump.
Integrity (I:L): Attackers could change some data, but it’s limited—not everything goes.
Availability (A:N): Service keeps running; no real outage angle.

2.8

2.7

[email protected]

4.3

2.0

MEDIUM

AV:N/AC:M/Au:N/C:N/I:P/A:N Click to expand

Access vector (AV:N): Can be exploited remotely over network reachability.
Access complexity (AC:M): Exploitation needs some favorable conditions, but not exceptional ones.
Authentication (AU:N): No authentication is required.
Confidentiality impact (C:N): No confidentiality impact.
Integrity impact (I:P): Partial integrity impact.
Availability impact (A:N): No availability impact.

8.6

2.9

[email protected]

Affected software / configurations for CVE-2017-2171

Vendor	Product	Version	Raw CPE
bestwebsoft	captcha	<= 4.2.9	cpe:2.3:a:bestwebsoft:captcha::::::wordpress::*
bestwebsoft	car_rental	<= 1.0.4	cpe:2.3:a:bestwebsoft:car_rental::::::wordpress::*
bestwebsoft	contact_form	<= 4.0.5	cpe:2.3:a:bestwebsoft:contact_form::::::wordpress::*
bestwebsoft	contact_form_multi	<= 1.2.0	cpe:2.3:a:bestwebsoft:contact_form_multi::::::wordpress::*
bestwebsoft	contact_form_to_db	<= 1.5.6	cpe:2.3:a:bestwebsoft:contact_form_to_db::::::wordpress::*
bestwebsoft	custom_admin_page	<= 0.1.1	cpe:2.3:a:bestwebsoft:custom_admin_page::::::wordpress::*
bestwebsoft	custom_fields_search	<= 1.3.1	cpe:2.3:a:bestwebsoft:custom_fields_search::::::wordpress::*
bestwebsoft	custom_search	<= 1.35	cpe:2.3:a:bestwebsoft:custom_search::::::wordpress::*
bestwebsoft	donate	<= 2.1.0	cpe:2.3:a:bestwebsoft:donate::::::wordpress::*
bestwebsoft	email_queue	<= 1.1.1	cpe:2.3:a:bestwebsoft:email_queue::::::wordpress::*
bestwebsoft	error_log_viewer	<= 1.0.5	cpe:2.3:a:bestwebsoft:error_log_viewer::::::wordpress::*
bestwebsoft	facebook_button	<= 2.53	cpe:2.3:a:bestwebsoft:facebook_button::::::wordpress::*
bestwebsoft	featured_posts	<= 1.0.0	cpe:2.3:a:bestwebsoft:featured_posts::::::wordpress::*
bestwebsoft	gallery	<= 4.4.9	cpe:2.3:a:bestwebsoft:gallery::::::wordpress::*
bestwebsoft	gallery_categories	<= 1.0.8	cpe:2.3:a:bestwebsoft:gallery_categories::::::wordpress::*
bestwebsoft	google_\+1	<= 1.3.3	cpe:2.3:a:bestwebsoft:google_\+1::::::wordpress::*
bestwebsoft	google_adsense	<= 1.43	cpe:2.3:a:bestwebsoft:google_adsense::::::wordpress::*
bestwebsoft	google_analytics	<= 1.7.0	cpe:2.3:a:bestwebsoft:google_analytics::::::wordpress::*
bestwebsoft	google_captcha_\(recaptcha\)	<= 1.27	cpe:2.3:a:bestwebsoft:google_captcha_\(recaptcha\)::::::wordpress::*
bestwebsoft	google_maps	<= 1.3.5	cpe:2.3:a:bestwebsoft:google_maps::::::wordpress::*
bestwebsoft	google_shortlink	<= 1.5.2	cpe:2.3:a:bestwebsoft:google_shortlink::::::wordpress::*
bestwebsoft	google_sitemap	<= 3.0.7	cpe:2.3:a:bestwebsoft:google_sitemap::::::wordpress::*
bestwebsoft	htaccess	<= 1.7.5	cpe:2.3:a:bestwebsoft:htaccess::::::wordpress::*
bestwebsoft	job_board	<= 1.1.2	cpe:2.3:a:bestwebsoft:job_board::::::wordpress::*
bestwebsoft	latest_posts	<= 0.2	cpe:2.3:a:bestwebsoft:latest_posts::::::wordpress::*
bestwebsoft	limit_attempts	<= 1.1.7	cpe:2.3:a:bestwebsoft:limit_attempts::::::wordpress::*
bestwebsoft	linkedin	<= 1.0.4	cpe:2.3:a:bestwebsoft:linkedin::::::wordpress::*
bestwebsoft	multilanguage	<= 1.2.1	cpe:2.3:a:bestwebsoft:multilanguage::::::wordpress::*
bestwebsoft	pagination	<= 1.0.6	cpe:2.3:a:bestwebsoft:pagination::::::wordpress::*
bestwebsoft	pdf_\&_print	<= 1.9.3	cpe:2.3:a:bestwebsoft:pdf_\&_print::::::wordpress::*
bestwebsoft	pinterest	<= 1.0.4	cpe:2.3:a:bestwebsoft:pinterest::::::wordpress::*
bestwebsoft	popular_posts	<= 1.0.4	cpe:2.3:a:bestwebsoft:popular_posts::::::wordpress::*
bestwebsoft	portfolio	<= 2.3	cpe:2.3:a:bestwebsoft:portfolio::::::wordpress::*
bestwebsoft	post_to_csv	<= 1.3.0	cpe:2.3:a:bestwebsoft:post_to_csv::::::wordpress::*
bestwebsoft	profile_extra	<= 1.0.6	cpe:2.3:a:bestwebsoft:profile_extra::::::wordpress::*
bestwebsoft	promobar	<= 1.1.0	cpe:2.3:a:bestwebsoft:promobar::::::wordpress::*
bestwebsoft	quotes_and_tips	<= 1.31	cpe:2.3:a:bestwebsoft:quotes_and_tips::::::wordpress::*
bestwebsoft	re-attacher	<= 1.0.8	cpe:2.3:a:bestwebsoft:re-attacher::::::wordpress::*
bestwebsoft	realty	<= 1.0.9	cpe:2.3:a:bestwebsoft:realty::::::wordpress::*
bestwebsoft	relevant_-_related_posts	<= 1.1.9	cpe:2.3:a:bestwebsoft:relevant_-_related_posts::::::wordpress::*
bestwebsoft	sender	<= 1.2.0	cpe:2.3:a:bestwebsoft:sender::::::wordpress::*
bestwebsoft	smtp	<= 1.0.9	cpe:2.3:a:bestwebsoft:smtp::::::wordpress::*
bestwebsoft	social_buttons_pack	<= 1.1.0	cpe:2.3:a:bestwebsoft:social_buttons_pack::::::wordpress::*
bestwebsoft	subscriber	<= 1.3.4	cpe:2.3:a:bestwebsoft:subscriber::::::wordpress::*
bestwebsoft	testimonials	<= 0.1.8	cpe:2.3:a:bestwebsoft:testimonials::::::wordpress::*
bestwebsoft	timesheet	<= 0.1.4	cpe:2.3:a:bestwebsoft:timesheet::::::wordpress::*
bestwebsoft	twitter_button	<= 2.54	cpe:2.3:a:bestwebsoft:twitter_button::::::wordpress::*
bestwebsoft	updater	<= 1.34	cpe:2.3:a:bestwebsoft:updater::::::wordpress::*
bestwebsoft	user_role	<= 1.5.5	cpe:2.3:a:bestwebsoft:user_role::::::wordpress::*
bestwebsoft	visitors_online	<= 0.9	cpe:2.3:a:bestwebsoft:visitors_online::::::wordpress::*
bestwebsoft	zendesk_help_center	<= 1.0.4	cpe:2.3:a:bestwebsoft:zendesk_help_center::::::wordpress::*

References for CVE-2017-2171

URL	Tags
http://jvndb.jvn.jp/jvndb/JVNDB-2017-000094	Third Party Advisory VDB Entry
https://jvn.jp/en/jp/JVN24834813/index.html	Third Party Advisory VDB Entry

URL

CVE-2017-2171

Exploit prediction scoring system (EPSS) score for CVE-2017-2171

Common vulnerability scoring system (CVSS) metrics for CVE-2017-2171

Weakness enumeration for CVE-2017-2171

Affected software / configurations for CVE-2017-2171

References for CVE-2017-2171