Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 7

Export CSV
CVE-2025-8420

Multiple Plugins by emarket-design <= Multiple Versions - Unauthenticated Limited Remote Code Execution

Multiple plugins for WordPress by emarket-design with the 'emd-form-builder-lite' package are vulnerable to Remote Code Execution in various versions via the emd_form_builder_lite_pagenum function. This is due to the plugin not properly validating user input before using it as a function name. This makes it possible for unauthenticated attackers to execute code on the server, however, parameters can not be passed to the functions called

CVSS 3.1 · 8.1 High EPSS 1.2% KEV · Not listed
Vendors
Emarketdesign Wordpress
Products
Request A Quote Wordpress
CVE-2025-64248

WordPress Request a Quote plugin <= 2.5.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in emarket-design Request a Quote request-a-quote allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Request a Quote: from n/a through <= 2.5.3.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Emarketdesign Wordpress
Products
Request A Quote Wordpress
CVE-2024-6231

Request a Quote < 2.4.1 - Admin+ Stored XSS

The Request a Quote WordPress plugin before 2.4.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Emarketdesign
Products
Request A Quote
CVE-2022-2240

Request a Quote <= 2.3.7 - CSV Injection

The Request a Quote WordPress plugin through 2.3.7 does not validate uploaded CSV files, allowing unauthenticated users to attach a malicious CSV file to a quote, which could lead to a CSV injection once an admin download and open it

CVSS 3.1 · 8.8 High EPSS 1.4% KEV · Not listed
Vendors
Emarketdesign
Products
Request A Quote
CVE-2022-2239

Request a Quote < 2.3.9 - Admin+ Stored Cross-Site Scripting

The Request a Quote WordPress plugin before 2.3.9 does not sanitise and escape some of its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Emarketdesign
Products
Request A Quote
CVE-2021-24489

Request a Quote < 2.3.9 - Admin+ Stored Cross-Site Scripting

The Request a Quote WordPress plugin before 2.3.9 does not sanitise, validate or escape some of its settings in the admin dashboard, leading to authenticated Stored Cross-Site Scripting issues even when the unfiltered_html capability is disallowed.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Emarketdesign
Products
Request A Quote
CVE-2021-24420

Request a Quote < 2.3.4 - Authenticated Stored XSS

The Request a Quote WordPress plugin before 2.3.4 did not sanitise and escape some of its quote fields when adding/editing a quote as admin, leading to Stored Cross-Site scripting issues when the quote is output in the 'All Quotes" table.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Emarketdesign
Products
Request A Quote