CveMateVulnerability intelligence

Emarket Design vulnerabilities

26 vulnerabilities

Known vulnerabilities in Emarket Design products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 18 products.

Products

18

Campus Directory – Faculty, Staff & Student Directory Plugin For Wordpress3 vulnerabilities
Simple Contact Form Plugin For Wordpress – WP Easy Contact3 vulnerabilities
Customer Support Ticket System & Helpdesk2 vulnerabilities
Employee Directory – Staff & Team Directory2 vulnerabilities
Employee Spotlight – Team Member Showcase & Meet The Team Plugin2 vulnerabilities
Event RSVP And Simple Event Management Plugin2 vulnerabilities
Project Management, Bug And Issue Tracking Plugin – Software Issue Manager2 vulnerabilities
Request A Quote2 vulnerabilities
Video Gallery – Youtube Gallery & Responsive Video Playlist2 vulnerabilities
Video Gallery – Youtube Gallery, Playlist & Video Grid2 vulnerabilities
WP Ticket Customer Service Software & Support Ticket System2 vulnerabilities
Youtube Showcase2 vulnerabilities
Customer Support Ticket System & Helpdesk Plugin For Wordpress1 vulnerabilities
Employee Directory – Staff Listing & Team Directory Plugin For Wordpress1 vulnerabilities
Employee Spotlight1 vulnerabilities
Request A Quote – Quote Forms For Any Wordpress Site1 vulnerabilities
Request A Quote Form Plugin – Price Quote Request Management Made Easy1 vulnerabilities
WP Easy Contact1 vulnerabilities

CVE-2025-54731emarket-designyoutube showcase+11y ago28-08-2025 12:37

Improper Control of Generation of Code ('Code Injection') vulnerability in emarket-design YouTube Showcase youtube-showcase allows Object Injection.This issue affects YouTube Showcase: from n/a through <= 3.5.1.CVE-2025-13403emarket-designemployee spotlight – team member showcase & meet the team plugin+110mo ago13-12-2025 03:20

The Employee Spotlight – Team Member Showcase & Meet the Team Plugin for WordPress is vulnerable to unauthorized tracking settings modification due to missing authorization validation on the employee_spotlight_check_optin() function in all versions up to, and including, 5.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enable or disable tracking settings.CVE-2025-53243emarket-designemployee directory – staff listing & team directory plugin for wordpress+11y ago28-08-2025 12:37

Deserialization of Untrusted Data vulnerability in emarket-design Employee Directory – Staff Listing & Team Directory Plugin for WordPress employee-directory allows Object Injection.This issue affects Employee Directory – Staff Listing & Team Directory Plugin for WordPress: from n/a through <= 4.5.5.CVE-2025-53572emarket-designwp easy contact+11y ago28-08-2025 12:37

Deserialization of Untrusted Data vulnerability in emarket-design WP Easy Contact wp-easy-contact allows Object Injection.This issue affects WP Easy Contact: from n/a through <= 4.0.1.CVE-2025-53584emarket-designwp ticket customer service software & support ticket system+11y ago28-08-2025 12:37

Deserialization of Untrusted Data vulnerability in emarket-design WP Ticket Customer Service Software & Support Ticket System wp-ticket allows Object Injection.This issue affects WP Ticket Customer Service Software & Support Ticket System: from n/a through <= 6.0.2.CVE-2025-53583emarket-designemployee spotlight+11y ago28-08-2025 12:37

Deserialization of Untrusted Data vulnerability in emarket-design Employee Spotlight employee-spotlight allows Object Injection.This issue affects Employee Spotlight: from n/a through <= 5.1.1.CVE-2025-58915emarket-designrequest a quote+41y ago23-09-2025 02:08

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in emarket-design Request a Quote request-a-quote allows Stored XSS.This issue affects Request a Quote: from n/a through <= 2.5.0.CVE-2025-5532emarket-designcampus directory – faculty, staff & student directory plugin for wordpress+11y ago04-06-2025 03:40

The Campus Directory – Faculty, Staff & Student Directory Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emd_mb_meta' shortcode in all versions up to, and including, 1.9.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2025-5531emarket-designemployee directory – staff & team directory+11y ago04-06-2025 03:40

The Employee Directory – Staff Listing & Team Directory Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emd_mb_meta' shortcode in all versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2025-5539emarket-designsimple contact form plugin for wordpress – wp easy contact+21y ago04-06-2025 04:22

The Simple Contact Form Plugin for WordPress – WP Easy Contact plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emd_mb_meta' shortcode in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2025-5540emarket-designevent rsvp and simple event management plugin+21y ago26-06-2025 02:06

The Event RSVP and Simple Event Management Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emd_mb_meta' shortcode in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2025-64248emarket-designrequest a quote+110mo ago16-12-2025 08:12

Missing Authorization vulnerability in emarket-design Request a Quote request-a-quote allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Request a Quote: from n/a through <= 2.5.3.CVE-2025-15636emarket-designyoutube showcase+16mo ago15-04-2026 15:55

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in emarket-design YouTube Showcase youtube-showcase allows Stored XSS.This issue affects YouTube Showcase: from n/a through <= 3.5.1.CVE-2025-12090emarket-designemployee spotlight – team member showcase & meet the team plugin+111mo ago01-11-2025 05:40

The Employee Spotlight – Team Member Showcase & Meet the Team Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Social URLs in all versions up to, and including, 5.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2025-8314emarket-designproject management, bug and issue tracking plugin – software issue manager+11y ago12-08-2025 04:25

The Software Issue Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg parameter in all versions up to, and including, 5.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2025-8295emarket-designemployee directory – staff & team directory+11y ago05-08-2025 07:24

The Employee Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg’ parameter in all versions up to, and including, 4.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2025-8313emarket-designcampus directory – faculty, staff & student directory plugin for wordpress+11y ago05-08-2025 06:39

The Campus Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg’ parameter in all versions up to, and including, 1.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2025-8315emarket-designsimple contact form plugin for wordpress – wp easy contact+11y ago05-08-2025 06:39

The WP Easy Contact plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg’ parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2025-8420cyberlord92employee directory – staff directory and listing+151y ago06-08-2025 02:24

Multiple plugins for WordPress by emarket-design with the 'emd-form-builder-lite' package are vulnerable to Remote Code Execution in various versions via the emd_form_builder_lite_pagenum function. This is due to the plugin not properly validating user input before using it as a function name. This makes it possible for unauthenticated attackers to execute code on the server, however, parameters can not be passed to the functions called CVE-2025-60157emarket-designwp ticket customer service software & support ticket system+11y ago26-09-2025 08:31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in emarket-design WP Ticket Customer Service Software & Support Ticket System wp-ticket allows Stored XSS.This issue affects WP Ticket Customer Service Software & Support Ticket System: from n/a through <= 6.0.2.