Emarket Design vulnerabilities
26 vulnerabilities
Known vulnerabilities in Emarket Design products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 18 products.
Products
18- Campus Directory – Faculty, Staff & Student Directory Plugin For Wordpress3 vulnerabilities
- Simple Contact Form Plugin For Wordpress – WP Easy Contact3 vulnerabilities
- Customer Support Ticket System & Helpdesk2 vulnerabilities
- Employee Directory – Staff & Team Directory2 vulnerabilities
- Employee Spotlight – Team Member Showcase & Meet The Team Plugin2 vulnerabilities
- Event RSVP And Simple Event Management Plugin2 vulnerabilities
- Project Management, Bug And Issue Tracking Plugin – Software Issue Manager2 vulnerabilities
- Request A Quote2 vulnerabilities
- Video Gallery – Youtube Gallery & Responsive Video Playlist2 vulnerabilities
- Video Gallery – Youtube Gallery, Playlist & Video Grid2 vulnerabilities
- WP Ticket Customer Service Software & Support Ticket System2 vulnerabilities
- Youtube Showcase2 vulnerabilities
- Customer Support Ticket System & Helpdesk Plugin For Wordpress1 vulnerabilities
- Employee Directory – Staff Listing & Team Directory Plugin For Wordpress1 vulnerabilities
- Employee Spotlight1 vulnerabilities
- Request A Quote – Quote Forms For Any Wordpress Site1 vulnerabilities
- Request A Quote Form Plugin – Price Quote Request Management Made Easy1 vulnerabilities
- WP Easy Contact1 vulnerabilities
HighCVE-2025-54731emarket-design · youtube showcase +1 moreWordPress YouTube Showcase Plugin <= 3.5.1 - PHP Object Injection VulnerabilityImproper Control of Generation of Code ('Code Injection') vulnerability in emarket-design YouTube Showcase youtube-showcase allows Object Injection.This issue affects YouTube Showcase: from n/a through <= 3.5.1.EPSS0.31%MediumCVE-2025-13403emarket-design · employee spotlight – team member showcase & meet the team plugin +1 moreEmployee Spotlight – Team Member Showcase & Meet the Team Plugin <= 5.1.3 - Missing Authorization to Authenticated (Subscriber+) Tracking Opt-In/Opt-Out ModificationThe Employee Spotlight – Team Member Showcase & Meet the Team Plugin for WordPress is vulnerable to unauthorized tracking settings modification due to missing authorization validation on the employee_spotlight_check_optin() function in all versions up to, and including, 5.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enable or disable tracking settings.EPSS0.23%HighCVE-2025-53243emarket-design · employee directory – staff listing & team directory plugin for wordpress +1 moreWordPress Employee Directory – Staff Listing & Team Directory plugin for WordPress plugin <= 4.5.5 - PHP Object Injection vulnerabilityDeserialization of Untrusted Data vulnerability in emarket-design Employee Directory – Staff Listing & Team Directory Plugin for WordPress employee-directory allows Object Injection.This issue affects Employee Directory – Staff Listing & Team Directory Plugin for WordPress: from n/a through <= 4.5.5.EPSS0.33%HighCVE-2025-53572emarket-design · wp easy contact +1 moreWordPress WP Easy Contact Plugin <= 4.0.1 - PHP Object Injection VulnerabilityDeserialization of Untrusted Data vulnerability in emarket-design WP Easy Contact wp-easy-contact allows Object Injection.This issue affects WP Easy Contact: from n/a through <= 4.0.1.EPSS0.33%HighCVE-2025-53584emarket-design · wp ticket customer service software & support ticket system +1 moreWordPress WP Ticket Customer Service Software & Support Ticket System Plugin <= 6.0.2 - PHP Object Injection VulnerabilityDeserialization of Untrusted Data vulnerability in emarket-design WP Ticket Customer Service Software & Support Ticket System wp-ticket allows Object Injection.This issue affects WP Ticket Customer Service Software & Support Ticket System: from n/a through <= 6.0.2.EPSS0.33%HighCVE-2025-53583emarket-design · employee spotlight +1 moreWordPress Employee Spotlight Plugin <= 5.1.1 - PHP Object Injection VulnerabilityDeserialization of Untrusted Data vulnerability in emarket-design Employee Spotlight employee-spotlight allows Object Injection.This issue affects Employee Spotlight: from n/a through <= 5.1.1.EPSS0.33%MediumCVE-2025-58915emarket-design · request a quote +4 moreWordPress Request a Quote plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in emarket-design Request a Quote request-a-quote allows Stored XSS.This issue affects Request a Quote: from n/a through <= 2.5.0.EPSS0.17%MediumCVE-2025-5532emarket-design · campus directory – faculty, staff & student directory plugin for wordpress +1 moreFaculty Staff and Student Directory Plugin – Campus Directory <= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingThe Campus Directory – Faculty, Staff & Student Directory Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emd_mb_meta' shortcode in all versions up to, and including, 1.9.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.EPSS0.22%MediumCVE-2025-5531emarket-design · employee directory – staff & team directory +1 moreStaff Directory – Employee Directory for WordPress <= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingThe Employee Directory – Staff Listing & Team Directory Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emd_mb_meta' shortcode in all versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.EPSS0.22%MediumCVE-2025-5539emarket-design · simple contact form plugin for wordpress – wp easy contact +2 moreSimplify Contact Management: WP Easy Contact <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingThe Simple Contact Form Plugin for WordPress – WP Easy Contact plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emd_mb_meta' shortcode in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.EPSS0.22%MediumCVE-2025-5540emarket-design · event rsvp and simple event management plugin +2 moreEvent RSVP and Simple Event Management Plugin <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingThe Event RSVP and Simple Event Management Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emd_mb_meta' shortcode in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.EPSS0.24%MediumCVE-2025-64248emarket-design · request a quote +1 moreWordPress Request a Quote plugin <= 2.5.3 - Broken Access Control vulnerabilityMissing Authorization vulnerability in emarket-design Request a Quote request-a-quote allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Request a Quote: from n/a through <= 2.5.3.EPSS0.22%MediumCVE-2025-15636emarket-design · youtube showcase +1 moreWordPress YouTube Showcase plugin <= 3.5.1 - Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in emarket-design YouTube Showcase youtube-showcase allows Stored XSS.This issue affects YouTube Showcase: from n/a through <= 3.5.1.EPSS0.16%MediumCVE-2025-12090emarket-design · employee spotlight – team member showcase & meet the team plugin +1 moreEmployee Spotlight – Team Member Showcase & Meet the Team Plugin <= 5.1.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingThe Employee Spotlight – Team Member Showcase & Meet the Team Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Social URLs in all versions up to, and including, 5.1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.EPSS0.19%MediumCVE-2025-8314emarket-design · project management, bug and issue tracking plugin – software issue manager +1 moreSoftware Issue Manager <= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via noaccess_msg ParameterThe Software Issue Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg parameter in all versions up to, and including, 5.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.EPSS0.27%MediumCVE-2025-8295emarket-design · employee directory – staff & team directory +1 moreEmployee Directory <= 4.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via noaccess_msg ParameterThe Employee Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg’ parameter in all versions up to, and including, 4.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.EPSS0.25%MediumCVE-2025-8313emarket-design · campus directory – faculty, staff & student directory plugin for wordpress +1 moreCampus Directory <= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via noaccess_msg ParameterThe Campus Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg’ parameter in all versions up to, and including, 1.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.EPSS0.25%MediumCVE-2025-8315emarket-design · simple contact form plugin for wordpress – wp easy contact +1 moreWP Easy Contact <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via noaccess_msg ParameterThe WP Easy Contact plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg’ parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.EPSS0.25%HighCVE-2025-8420cyberlord92 · employee directory – staff directory and listing +15 moreMultiple Plugins by emarket-design <= Multiple Versions - Unauthenticated Limited Remote Code ExecutionMultiple plugins for WordPress by emarket-design with the 'emd-form-builder-lite' package are vulnerable to Remote Code Execution in various versions via the emd_form_builder_lite_pagenum function. This is due to the plugin not properly validating user input before using it as a function name. This makes it possible for unauthenticated attackers to execute code on the server, however, parameters can not be passed to the functions calledEPSS1.00%MediumCVE-2025-60157emarket-design · wp ticket customer service software & support ticket system +1 moreWordPress WP Ticket Customer Service Software & Support Ticket System Plugin <= 6.0.2 - Cross Site Scripting (XSS) VulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in emarket-design WP Ticket Customer Service Software & Support Ticket System wp-ticket allows Stored XSS.This issue affects WP Ticket Customer Service Software & Support Ticket System: from n/a through <= 6.0.2.EPSS0.23%