{"schemaVersion":3,"id":"CVE-2025-8420","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Multiple plugins for WordPress by emarket-design with the 'emd-form-builder-lite' package are vulnerable to Remote Code Execution in various versions via the emd_form_builder_lite_pagenum function. This is due to the plugin not properly validating user input before using it as a function name. This makes it possible for unauthenticated attackers to execute code on the server, however, parameters can not be passed to the functions called","dates":{"published":"2025-08-06T02:24:12.120Z","modified":"2026-04-08T16:56:28.904Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":8.1,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":8.1,"severity":"high","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":8.1,"severity":"high","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"wordfence","score":8.1,"severity":"high","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.01002,"percentile":0.6251,"severity":"low","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":0.006999999999999888,"baselineDate":"2026-09-21T00:00:00.000Z","baselineScore":0.00995},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.0096,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.0096,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00995,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00995,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00995,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00995,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00995,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00995,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00995,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00995,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00995,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00995,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00995,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00995,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00995,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00995,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00995,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00995,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00995,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00995,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00995,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00995,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01002,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01002,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01002,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01002,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01002,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01002,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01002,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01002,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01002,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01002,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01002,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01002,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01002,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01002,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.01002,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.01002,"percentile":0.6251}],"last30":[{"date":"2026-09-21T00:00:00.000Z","score":0.00995,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00995,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00995,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00995,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00995,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00995,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00995,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00995,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00995,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00995,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00995,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00995,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00995,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00995,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00995,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01002,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01002,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01002,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01002,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01002,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01002,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01002,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01002,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01002,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01002,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01002,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01002,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01002,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01002,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.01002,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.01002,"percentile":0.6251}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-95","name":"Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","description":"The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. \"eval\").","type":"weakness","status":"Incomplete","abstraction":"Variant","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/95.html"}],"affected":[{"vendor":"cyberlord92","product":"employee directory – staff directory and listing","name":"Employee Directory – Staff Directory and Listing","label":"employee directory – staff directory and listing","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 4.5.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 4.5.2","eol":null,"hubHref":"/vendor/cyberlord92/employee_directory_-_staff_directory_and_listing"},{"vendor":"emarket-design","product":"campus directory – faculty, staff & student directory plugin for wordpress","name":"Campus Directory – Faculty, Staff & Student Directory Plugin for WordPress","label":"campus directory – faculty, staff & student directory plugin for wordpress","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 1.9.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 1.9.2","eol":null,"hubHref":"/vendor/emarket-design/campus_directory_-_faculty_staff__student_directory_plugin_for_wordpress"},{"vendor":"emarket-design","product":"customer support ticket system & helpdesk plugin for wordpress","name":"Customer Support Ticket System & Helpdesk Plugin for WordPress","label":"customer support ticket system & helpdesk plugin for wordpress","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 6.0.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 6.0.1","eol":null,"hubHref":"/vendor/emarket-design/customer_support_ticket_system__helpdesk_plugin_for_wordpress"},{"vendor":"emarket-design","product":"event rsvp and simple event management plugin","name":"Event RSVP and Simple Event Management Plugin","label":"event rsvp and simple event management plugin","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 4.2.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 4.2.1","eol":null,"hubHref":"/vendor/emarket-design/event_rsvp_and_simple_event_management_plugin"},{"vendor":"emarket-design","product":"project management, bug and issue tracking plugin – software issue manager","name":"Project Management, Bug and Issue Tracking Plugin – Software Issue Manager","label":"project management, bug and issue tracking plugin – software issue manager","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 5.0.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 5.0.0","eol":null,"hubHref":"/vendor/emarket-design/project_management_bug_and_issue_tracking_plugin_-_software_issue_manager"},{"vendor":"emarket-design","product":"request a quote form plugin – price quote request management made easy","name":"Request a Quote Form Plugin – Price Quote Request Management Made Easy","label":"request a quote form plugin – price quote request management made easy","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 2.5.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 2.5.2","eol":null,"hubHref":"/vendor/emarket-design/request_a_quote_form_plugin_-_price_quote_request_management_made_easy"},{"vendor":"emarket-design","product":"simple contact form plugin for wordpress – wp easy contact","name":"Simple Contact Form Plugin for WordPress – WP Easy Contact","label":"simple contact form plugin for wordpress – wp easy contact","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 4.0.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 4.0.2","eol":null,"hubHref":"/vendor/emarket-design/simple_contact_form_plugin_for_wordpress_-_wp_easy_contact"},{"vendor":"emarket-design","product":"video gallery – youtube gallery & responsive video playlist","name":"Video Gallery – YouTube Gallery & Responsive Video Playlist","label":"video gallery – youtube gallery & responsive video playlist","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 3.5.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 3.5.2","eol":null,"hubHref":"/vendor/emarket-design/video_gallery_-_youtube_gallery__responsive_video_playlist"},{"vendor":"wordpress","product":"campus-directory","name":"Campus Directory – Faculty, Staff & Student Directory Plugin for WordPress","label":"campus-directory","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 1.9.2 (fixed in 1.9.3)","noFixRecorded":false,"fixedIn":"1.9.3"}],"versionsText":"≤ 1.9.2 (fixed in 1.9.3)","eol":null,"hubHref":null},{"vendor":"wordpress","product":"employee-staff-directory","name":"Employee Directory – Staff Directory and Listing","label":"employee-staff-directory","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 4.5.2 (fixed in 4.5.3)","noFixRecorded":false,"fixedIn":"4.5.3"}],"versionsText":"≤ 4.5.2 (fixed in 4.5.3)","eol":null,"hubHref":null},{"vendor":"wordpress","product":"request-a-quote","name":"Request a Quote – Quote Forms for Any WordPress Site","label":"request-a-quote","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 2.5.2 (fixed in 2.5.3)","noFixRecorded":false,"fixedIn":"2.5.3"}],"versionsText":"≤ 2.5.2 (fixed in 2.5.3)","eol":null,"hubHref":null},{"vendor":"wordpress","product":"software-issue-manager","name":"Project Management, Bug and Issue Tracking Plugin – Software Issue Manager","label":"software-issue-manager","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 5.0.0 (fixed in 5.0.1)","noFixRecorded":false,"fixedIn":"5.0.1"}],"versionsText":"≤ 5.0.0 (fixed in 5.0.1)","eol":null,"hubHref":null},{"vendor":"wordpress","product":"wp-easy-contact","name":"Simple Contact Form Plugin for WordPress – WP Easy Contact","label":"wp-easy-contact","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 4.0.2 (fixed in 4.0.3)","noFixRecorded":false,"fixedIn":"4.0.3"}],"versionsText":"≤ 4.0.2 (fixed in 4.0.3)","eol":null,"hubHref":null},{"vendor":"wordpress","product":"wp-easy-events","name":"Event RSVP and Simple Event Management Plugin","label":"wp-easy-events","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 4.2.1 (fixed in 4.2.2)","noFixRecorded":false,"fixedIn":"4.2.2"}],"versionsText":"≤ 4.2.1 (fixed in 4.2.2)","eol":null,"hubHref":null},{"vendor":"wordpress","product":"wp-ticket","name":"Customer Support Ticket System & Helpdesk","label":"wp-ticket","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 6.0.1 (fixed in 6.0.3)","noFixRecorded":false,"fixedIn":"6.0.3"}],"versionsText":"≤ 6.0.1 (fixed in 6.0.3)","eol":null,"hubHref":null},{"vendor":"wordpress","product":"youtube-showcase","name":"Video Gallery – YouTube Gallery, Playlist & Video Grid","label":"youtube-showcase","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 3.5.2 (fixed in 3.5.3)","noFixRecorded":false,"fixedIn":"3.5.3"}],"versionsText":"≤ 3.5.2 (fixed in 3.5.3)","eol":null,"hubHref":null}],"affectedCount":16,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/601aa2b5-aeac-49bc-960d-4b4ff83e9229?source=cve","label":"www.wordfence.com/threat-intel/vulnerabilities/id/601aa2b5-aeac-49bc-960d-4b4ff83e9229?source=cve","hostname":"www.wordfence.com","tags":[]},{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3338854%40request-a-quote&new=3338854%40request-a-quote&sfp_email=&sfph_mail=","label":"plugins.trac.wordpress.org/changeset","hostname":"plugins.trac.wordpress.org","tags":[]},{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3340992%40software-issue-manager&new=3340992%40software-issue-manager&sfp_email=&sfph_mail=","label":"plugins.trac.wordpress.org/changeset","hostname":"plugins.trac.wordpress.org","tags":[]},{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3341064%40wp-ticket&new=3341064%40wp-ticket&sfp_email=&sfph_mail=","label":"plugins.trac.wordpress.org/changeset","hostname":"plugins.trac.wordpress.org","tags":[]},{"url":"https://plugins.trac.wordpress.org/changeset/3346435/","label":"plugins.trac.wordpress.org/changeset/3346435/","hostname":"plugins.trac.wordpress.org","tags":[]},{"url":"https://plugins.trac.wordpress.org/changeset/3346460/","label":"plugins.trac.wordpress.org/changeset/3346460/","hostname":"plugins.trac.wordpress.org","tags":[]},{"url":"https://plugins.trac.wordpress.org/changeset/3347084/","label":"plugins.trac.wordpress.org/changeset/3347084/","hostname":"plugins.trac.wordpress.org","tags":[]},{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3348220%40wp-easy-events&new=3348220%40wp-easy-events&sfp_email=&sfph_mail=","label":"plugins.trac.wordpress.org/changeset","hostname":"plugins.trac.wordpress.org","tags":[]},{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3365190%40youtube-showcase&new=3365190%40youtube-showcase&sfp_email=&sfph_mail=","label":"plugins.trac.wordpress.org/changeset","hostname":"plugins.trac.wordpress.org","tags":[]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/601aa2b5-aeac-49bc-960d-4b4ff83e9229","label":"www.wordfence.com/threat-intel/vulnerabilities/id/601aa2b5-aeac-49bc-960d-4b4ff83e9229","hostname":"www.wordfence.com","tags":["Vendor Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2025-08-06T02:24:12.120Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-04-08T16:56:28.904Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":33,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T08:29:39.395Z","stale":false,"partial":false}}