CVE-2025-8420: cyberlord92 employee directory – staff directory and listing Eval Injection

Vulnerability summary

CVE-2025-8420 is a high (CVSS 8.1) Eval Injection vulnerability in cyberlord92 employee directory – staff directory and listing. EPSS estimates a 1.00% chance of exploitation in the next 30 days, higher than 62.5% of scored vulnerabilities. Fixed in 4.5.3.

Timeline

1. 06-08-2025
   PublishedVulnerability first disclosed.
2. 08-04-2026
   Last modifiedVulnerability information updated.

Description

Multiple plugins for WordPress by emarket-design with the 'emd-form-builder-lite' package are vulnerable to Remote Code Execution in various versions via the emd_form_builder_lite_pagenum function. This is due to the plugin not properly validating user input before using it as a function name. This makes it possible for unauthenticated attackers to execute code on the server, however, parameters can not be passed to the functions called

• CWE-95Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").