Skip to content
OpenAdvisories

Vendor

emarket-design

28 known vulnerabilities.

Products

YouTube Showcase 3 Simple Contact Form Plugin for WordPress – WP Easy Contact 3 Campus Directory – Faculty, Staff & Student Directory Plugin for WordPress 3 Customer Support Ticket System & Helpdesk 2 Video Gallery – YouTube Gallery & Responsive Video Playlist 2 Project Management, Bug and Issue Tracking Plugin – Software Issue Manager 2 Event RSVP and Simple Event Management Plugin 2 Employee Directory – Staff & Team Directory 2 WP Ticket Customer Service Software & Support Ticket System 2 Employee Spotlight – Team Member Showcase & Meet the Team Plugin 2 Request a Quote 2 Video Gallery – YouTube Gallery, Playlist & Video Grid 2 WP Easy Contact 1 Employee Spotlight 1 Request a Quote Form Plugin – Price Quote Request Management Made Easy 1 Customer Support Ticket System & Helpdesk Plugin for WordPress 1 Request a Quote – Quote Forms for Any WordPress Site 1 Employee Directory – Staff Listing & Team Directory Plugin for WordPress 1 YouTube Video Gallery by YouTube Showcase 1
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • High 7.1
    CVE-2026-61995

    WordPress YouTube Showcase plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in YouTube Showcase <= 4.1.0 versions.

    emarket-design YouTube Showcase
  • High 7.5
    CVE-2026-14249

    Request a Quote Form Plugin <= 2.5.5 - Unauthenticated Code Injection via 'path' Parameter

    The Request a Quote plugin for WordPress is vulnerable to Code Injection in versions up to, and including, 2.5.5 via the emd_delete_file AJAX action. This is due to the emd_delete_file() handler deriving a PHP function name from the attacker-controlled $_POST…

    emarket-design Request a Quote – Quote Forms for Any WordPress Site Web / CMS
  • High 7.5
    CVE-2026-12923

    Video Gallery <= 4.0.3 - Authenticated (Subscriber+) Arbitrary Function Call via 'path' Parameter

    The Youtube Showcase plugin for WordPress is vulnerable to Arbitrary Function Call in versions up to and including 4.0.3. This is due to insufficient validation of the 'path' parameter in the emd_delete_file() AJAX handler in includes/common-functions.php. Th…

    emarket-design Video Gallery – YouTube Gallery, Playlist & Video Grid Web / CMS
  • High 7.5
    CVE-2026-9848 Public exploit Scanner template

    WP Ticket <= 6.0.4 - Unauthenticated SQL Injection via WordPress Search 's' Parameter

    The WP Ticket plugin for WordPress is vulnerable to SQL Injection via the WordPress search query parameter (`s`) in versions up to, and including, 6.0.4 The plugin hooks WordPress's `posts_request` filter with `wp_ticket_com_posts_request()`, which calls `emd…

    emarket-design Customer Support Ticket System & Helpdesk Web / CMS
  • High 8.1
    CVE-2025-54731

    WordPress YouTube Showcase Plugin <= 3.5.1 - PHP Object Injection Vulnerability

    Improper Control of Generation of Code ('Code Injection') vulnerability in emarket-design YouTube Showcase youtube-showcase allows Object Injection.This issue affects YouTube Showcase: from n/a through <= 3.5.1.

    emarket-design YouTube Showcase
  • High 8.1
    CVE-2025-53583

    WordPress Employee Spotlight Plugin <= 5.1.1 - PHP Object Injection Vulnerability

    Deserialization of Untrusted Data vulnerability in emarket-design Employee Spotlight employee-spotlight allows Object Injection.This issue affects Employee Spotlight: from n/a through <= 5.1.1.

    emarket-design Employee Spotlight
  • High 8.1
    CVE-2025-53584

    WordPress WP Ticket Customer Service Software & Support Ticket System Plugin <= 6.0.2 - PHP Object Injection Vulnerability

    Deserialization of Untrusted Data vulnerability in emarket-design WP Ticket Customer Service Software & Support Ticket System wp-ticket allows Object Injection.This issue affects WP Ticket Customer Service Software & Support Ticket System: from n/a through <=…

    emarket-design WP Ticket Customer Service Software & Support Ticket System
  • High 8.1
    CVE-2025-53572

    WordPress WP Easy Contact Plugin <= 4.0.1 - PHP Object Injection Vulnerability

    Deserialization of Untrusted Data vulnerability in emarket-design WP Easy Contact wp-easy-contact allows Object Injection.This issue affects WP Easy Contact: from n/a through <= 4.0.1.

    emarket-design WP Easy Contact
  • High 8.1
    CVE-2025-53243

    WordPress Employee Directory – Staff Listing & Team Directory plugin for WordPress plugin <= 4.5.5 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in emarket-design Employee Directory – Staff Listing & Team Directory Plugin for WordPress employee-directory allows Object Injection.This issue affects Employee Directory – Staff Listing & Team Directory Plugin…

    emarket-design Employee Directory – Staff Listing & Team Directory Plugin for WordPress Web / CMS
  • High 8.1
    CVE-2025-8420

    Multiple Plugins by emarket-design <= Multiple Versions - Unauthenticated Limited Remote Code Execution

    Multiple plugins for WordPress by emarket-design with the 'emd-form-builder-lite' package are vulnerable to Remote Code Execution in various versions via the emd_form_builder_lite_pagenum function. This is due to the plugin not properly validating user input …

    cyberlord92 emarket-design Campus Directory – Faculty, Staff & Student Directory Plugin for WordPress Simple Contact Form Plugin for WordPress – WP Easy Contact Web / CMS