Emarketdesign vulnerabilities

11 vulnerabilities

Known vulnerabilities in Emarketdesign products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 6 products.

Products

6
4.8MediumCVE-2021-24489emarketdesign · request_a_quote +2 moreRequest a Quote < 2.3.9 - Admin+ Stored Cross-Site ScriptingThe Request a Quote WordPress plugin before 2.3.9 does not sanitise, validate or escape some of its settings in the admin dashboard, leading to authenticated Stored Cross-Site Scripting issues even when the unfiltered_html capability is disallowed.EPSS0.64%5.5MediumCVE-2021-24622emarketdesign · customer_service_software_\&_support_ticket_system +2 moreWP Ticket < 5.10.4 - Admin+ Stored Cross-Site ScriptingThe Customer Service Software & Support Ticket System WordPress plugin before 5.10.4 does not sanitize or escape form fields before outputting it in the List, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.EPSS0.64%5.4MediumCVE-2021-24420emarketdesign · request_a_quote +2 moreRequest a Quote < 2.3.4 - Authenticated Stored XSSThe Request a Quote WordPress plugin before 2.3.4 did not sanitise and escape some of its quote fields when adding/editing a quote as admin, leading to Stored Cross-Site scripting issues when the quote is output in the 'All Quotes" table.EPSS0.62%6.4MediumCVE-2025-5539emarket-design · simple contact form plugin for wordpress – wp easy contact +2 moreSimplify Contact Management: WP Easy Contact <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingThe Simple Contact Form Plugin for WordPress – WP Easy Contact plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emd_mb_meta' shortcode in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.EPSS0.22%6.4MediumCVE-2025-5540emarket-design · event rsvp and simple event management plugin +2 moreEvent RSVP and Simple Event Management Plugin <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingThe Event RSVP and Simple Event Management Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emd_mb_meta' shortcode in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.EPSS0.24%8.8HighCVE-2022-2240emarketdesign · request_a_quote +2 moreRequest a Quote <= 2.3.7 - CSV InjectionThe Request a Quote WordPress plugin through 2.3.7 does not validate uploaded CSV files, allowing unauthenticated users to attach a malicious CSV file to a quote, which could lead to a CSV injection once an admin download and open itEPSS1.43%4.8MediumCVE-2022-2151emarketdesign · best_contact_management_software +2 moreBest Contact Management Software <= 3.7.3 - Admin+ Stored Cross-Site ScriptingThe Best Contact Management Software WordPress plugin through 3.7.3 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.EPSS0.59%5.5MediumCVE-2022-2239emarketdesign · request_a_quote +2 moreRequest a Quote < 2.3.9 - Admin+ Stored Cross-Site ScriptingThe Request a Quote WordPress plugin before 2.3.9 does not sanitise and escape some of its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.EPSS0.65%5.9MediumCVE-2024-6231emarketdesign · request_a_quote +2 moreRequest a Quote < 2.4.1 - Admin+ Stored XSSThe Request a Quote WordPress plugin before 2.4.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)EPSS0.37%5.3MediumCVE-2024-3268emarket-design · video gallery – youtube gallery & responsive video playlist +2 moreYouTube Video Gallery by YouTube Showcase – Video Gallery Plugin for WordPress <= 3.3.6 - Missing Authorization to Arbitrary Post/Page CreationThe YouTube Video Gallery by YouTube Showcase – Video Gallery Plugin for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the emd_form_builder_lite_submit_form function in all versions up to, and including, 3.3.6. This makes it possible for unauthenticated attackers to create arbitrary posts or pages.EPSS0.33%8.8HighCVE-2023-40558emarket design · youtube video gallery by youtube showcase +2 moreWordPress Video Gallery & Management Plugin <= 3.3.5 is vulnerable to Cross Site Request Forgery (CSRF)Cross-Site Request Forgery (CSRF) vulnerability in eMarket Design YouTube Video Gallery by YouTube Showcase plugin <= 3.3.5 versions.EPSS0.25%