CVE-2014-125109

CVE-2014-125109 describes a Cross-Site Scripting (XSS) vulnerability in the BestWebSoft Portfolio Plugin, affecting versions up to 2.27. Specifically, the bws_add_menu_render function within the bws_menu/bws_menu.php file is susceptible to manipulation via the bwsmn_form_email argument. This allows for remote, unauthenticated attackers to inject malicious scripts into affected web pages. The vulnerability carries a CVSS v3.1 score of 6.1 (Medium), indicating a network-based attack with low complexity, requiring user interaction, and leading to low impact on confidentiality and integrity. While the EPSS score is very low, suggesting a minimal likelihood of exploitation, the FAUCET Risk Score is 30/100. There is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. The vulnerability has garnered no community discussion or media coverage, suggesting a low profile. Remediation involves upgrading to BestWebSoft Portfolio Plugin version 2.28.