Multiple Plugins by emarket-design <= Multiple Versions - Unauthenticated Limited Remote Code Execution
Priority MEDIUM 40CWE-95Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-95.
Summary
Multiple plugins for WordPress by emarket-design with the 'emd-form-builder-lite' package are vulnerable to Remote Code Execution in various versions via the emd_form_builder_lite_pagenum function. This is due to the plugin not properly validating user input before using it as a function name. This makes it possible for unauthenticated attackers to execute code on the server, however, parameters can not be passed to the functions called
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01161 67th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| emarket-design | Campus Directory – Faculty, Staff & Student Directory Plugin for WordPress | up to 1.9.2 | — | No fix listed | CNA |
| emarket-design | Request a Quote Form Plugin – Price Quote Request Management Made Easy | up to 2.5.2 | — | No fix listed | CNA |
| emarket-design | Video Gallery – YouTube Gallery & Responsive Video Playlist | up to 3.5.2 | — | No fix listed | CNA |
| emarket-design | Simple Contact Form Plugin for WordPress – WP Easy Contact | up to 4.0.2 | — | No fix listed | CNA |
| emarket-design | Event RSVP and Simple Event Management Plugin | up to 4.2.1 | — | No fix listed | CNA |
| miniOrange | Employee Directory – Staff Directory and Listing | up to 4.5.2 | — | No fix listed | CNA |
| emarket-design | Project Management, Bug and Issue Tracking Plugin – Software Issue Manager | up to 5.0.0 | — | No fix listed | CNA |
| emarket-design | Customer Support Ticket System & Helpdesk Plugin for WordPress | up to 6.0.1 | — | No fix listed | CNA |
- Campus Directory – Faculty, Staff & Student Directory Plugin for WordPress Vendoremarket-design Affected up to 1.9.2 Fixed in — No fix listed CNA
- Request a Quote Form Plugin – Price Quote Request Management Made Easy Vendoremarket-design Affected up to 2.5.2 Fixed in — No fix listed CNA
- Video Gallery – YouTube Gallery & Responsive Video Playlist Vendoremarket-design Affected up to 3.5.2 Fixed in — No fix listed CNA
- Simple Contact Form Plugin for WordPress – WP Easy Contact Vendoremarket-design Affected up to 4.0.2 Fixed in — No fix listed CNA
- Event RSVP and Simple Event Management Plugin Vendoremarket-design Affected up to 4.2.1 Fixed in — No fix listed CNA
- Employee Directory – Staff Directory and Listing VendorminiOrange Affected up to 4.5.2 Fixed in — No fix listed CNA
- Project Management, Bug and Issue Tracking Plugin – Software Issue Manager Vendoremarket-design Affected up to 5.0.0 Fixed in — No fix listed CNA
- Customer Support Ticket System & Helpdesk Plugin for WordPress Vendoremarket-design Affected up to 6.0.1 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-8420
- 2026-10-03 Alias added: GHSA-q943-6mg4-6px7
- 2026-11-08 Priority changed: LOW → MEDIUM
References
Other 9
- https://www.wordfence.com/threat-intel/vulnerabilities/id/601aa2b5-aeac-49bc-960d-4b4ff83e9229?source=cve
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3338854%40request-a-quote&new=3338854%40request-a-quote&sfp_email=&sfph_mail=
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3340992%40software-issue-manager&new=3340992%40software-issue-manager&sfp_email=&sfph_mail=
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3341064%40wp-ticket&new=3341064%40wp-ticket&sfp_email=&sfph_mail=
- https://plugins.trac.wordpress.org/changeset/3346435/
- https://plugins.trac.wordpress.org/changeset/3346460/
- https://plugins.trac.wordpress.org/changeset/3347084/
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3348220%40wp-easy-events&new=3348220%40wp-easy-events&sfp_email=&sfph_mail=
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3365190%40youtube-showcase&new=3365190%40youtube-showcase&sfp_email=&sfph_mail=
More emarket-design vulnerabilities
- TI-2024-05779 Request a Quote < 2.4.1 - Admin+ Stored XSS CVSS 3.1MEDIUM 5.9
- TI-2026-12634 Customer Support Ticket System & Helpdesk <= 6.0.5 - Unauthenticated Code Injection via 'path' Parameter CVSS 3.1CRITICAL 9.8
- TI-2026-08619 WP Ticket <= 6.0.4 - Unauthenticated SQL Injection via WordPress Search 's' Parameter CVSS 3.1HIGH 7.5
- TI-2022-02068 Request a Quote <= 2.3.7 - CSV Injection CVSS 3.1HIGH 8.8
- TI-2026-12066 Request a Quote Form Plugin <= 2.5.5 - Unauthenticated Code Injection via 'path' Parameter CVSS 3.1HIGH 7.5
- TI-2023-21363 WordPress Video Gallery & Management Plugin <= 3.3.5 is vulnerable to Cross Site Request Forgery (CSRF) CVSS 3.1HIGH 8.8
Sources
- CVE-2025-8420 · CVE Program
- CVE-2025-8420 · NVD
- FIRST EPSS
- GHSA-q943-6mg4-6px7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences