Emarket-Design
26 CVEs across 19 Emarket-Design products. Browse Emarket-Design vulnerabilities, severities, and proof-of-concept exploits.
Emarket-Design products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-15011 | Critical | 9.8 | 2026-07-23 | The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection via the 'path' parameter in all versions up to, and includin… |
CVE-2026-14249 | High | 7.5 | 2026-07-02 | The Request a Quote plugin for WordPress is vulnerable to Code Injection in versions up to, and including, 2.5.5 via the emd_delete_file AJAX action. This is d… |
CVE-2026-12923 | High | 7.5 | 2026-07-01 | The Youtube Showcase plugin for WordPress is vulnerable to Arbitrary Function Call in versions up to and including 4.0.3. This is due to insufficient validatio… |
CVE-2026-9848 | High | 7.5 | 2026-06-13 | The WP Ticket plugin for WordPress is vulnerable to SQL Injection via the WordPress search query parameter (`s`) in versions up to, and including, 6.0.4 The pl… |
CVE-2025-15636 | Medium | 6.5 | 2026-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in emarket-design YouTube Showcase youtube-showcase allows S… |
CVE-2025-64248 | Medium | 4.3 | 2025-12-16 | Missing Authorization vulnerability in emarket-design Request a Quote request-a-quote allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2025-13403 | Medium | 4.3 | 2025-12-13 | The Employee Spotlight – Team Member Showcase & Meet the Team Plugin for WordPress is vulnerable to unauthorized tracking settings modification due to missing… |
CVE-2025-12090 | Medium | 6.4 | 2025-11-01 | The Employee Spotlight – Team Member Showcase & Meet the Team Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Social URLs in all v… |
CVE-2025-60157 | Medium | 6.5 | 2025-09-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in emarket-design WP Ticket Customer Service Software & Supp… |
CVE-2025-58915 | Medium | 6.5 | 2025-09-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in emarket-design Request a Quote request-a-quote allows Sto… |
CVE-2025-54731 | High | 8.1 | 2025-08-28 | Improper Control of Generation of Code ('Code Injection') vulnerability in emarket-design YouTube Showcase youtube-showcase allows Object Injection.This issue… |
CVE-2025-53584 | High | 8.1 | 2025-08-28 | Deserialization of Untrusted Data vulnerability in emarket-design WP Ticket Customer Service Software & Support Ticket System wp-ticket allows Object Injection… |
CVE-2025-53583 | High | 8.1 | 2025-08-28 | Deserialization of Untrusted Data vulnerability in emarket-design Employee Spotlight employee-spotlight allows Object Injection.This issue affects Employee Spo… |
CVE-2025-53572 | High | 8.1 | 2025-08-28 | Deserialization of Untrusted Data vulnerability in emarket-design WP Easy Contact wp-easy-contact allows Object Injection.This issue affects WP Easy Contact: f… |
CVE-2025-53243 | High | 8.1 | 2025-08-28 | Deserialization of Untrusted Data vulnerability in emarket-design Employee Directory – Staff Listing & Team Directory Plugin for WordPress employee-directory a… |
CVE-2025-8314 | Medium | 6.4 | 2025-08-12 | The Software Issue Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg parameter in all versions up to, and includi… |
CVE-2025-8420 | High | 8.1 | 2025-08-06 | Multiple plugins for WordPress by emarket-design with the 'emd-form-builder-lite' package are vulnerable to Remote Code Execution in various versions via the e… |
CVE-2025-8295 | Medium | 6.4 | 2025-08-05 | The Employee Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg’ parameter in all versions up to, and including… |
CVE-2025-8315 | Medium | 6.4 | 2025-08-05 | The WP Easy Contact plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg’ parameter in all versions up to, and including, 4… |
CVE-2025-8313 | Medium | 6.4 | 2025-08-05 | The Campus Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg’ parameter in all versions up to, and including, 1… |
CVE-2025-5540 | Medium | 6.4 | 2025-06-26 | The Event RSVP and Simple Event Management Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emd_mb_meta' shortcode in… |
CVE-2025-5539 | Medium | 6.4 | 2025-06-04 | The Simple Contact Form Plugin for WordPress – WP Easy Contact plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emd_mb_meta'… |
CVE-2025-5532 | Medium | 6.4 | 2025-06-04 | The Campus Directory – Faculty, Staff & Student Directory Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin… |
CVE-2025-5531 | Medium | 6.4 | 2025-06-04 | The Employee Directory – Staff Listing & Team Directory Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's… |
CVE-2024-3268 | Medium | 5.3 | 2024-05-21 | The YouTube Video Gallery by YouTube Showcase – Video Gallery Plugin for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due… |
CVE-2023-40558 | Medium | 5.4 | 2023-10-03 | Cross-Site Request Forgery (CSRF) vulnerability in eMarket Design YouTube Video Gallery by YouTube Showcase plugin <= 3.3.5 versions. |