Skip to content
OpenAdvisories

Vendor

emarket-design

28 known vulnerabilities.

Products

YouTube Showcase 3 Simple Contact Form Plugin for WordPress – WP Easy Contact 3 Campus Directory – Faculty, Staff & Student Directory Plugin for WordPress 3 Customer Support Ticket System & Helpdesk 2 Video Gallery – YouTube Gallery & Responsive Video Playlist 2 Project Management, Bug and Issue Tracking Plugin – Software Issue Manager 2 Event RSVP and Simple Event Management Plugin 2 Employee Directory – Staff & Team Directory 2 WP Ticket Customer Service Software & Support Ticket System 2 Employee Spotlight – Team Member Showcase & Meet the Team Plugin 2 Request a Quote 2 Video Gallery – YouTube Gallery, Playlist & Video Grid 2 WP Easy Contact 1 Employee Spotlight 1 Request a Quote Form Plugin – Price Quote Request Management Made Easy 1 Customer Support Ticket System & Helpdesk Plugin for WordPress 1 Request a Quote – Quote Forms for Any WordPress Site 1 Employee Directory – Staff Listing & Team Directory Plugin for WordPress 1 YouTube Video Gallery by YouTube Showcase 1
All Critical High Medium Low Exploited only Public exploit

17 results · Clear filters · Feed

  • Medium 6.4
    CVE-2026-15790

    Video Gallery <= 4.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment 'post_title' via emd_mb_meta Shortcode

    The Youtube Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.0.4 via the 'emd_mb_meta' shortcode. This is due to insufficient input sanitization and output escaping on attachment titles referenced …

    emarket-design Video Gallery – YouTube Gallery, Playlist & Video Grid Web / CMS
  • Medium 6.5
    CVE-2025-15636

    WordPress YouTube Showcase plugin <= 3.5.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in emarket-design YouTube Showcase youtube-showcase allows Stored XSS.This issue affects YouTube Showcase: from n/a through <= 3.5.1.

    emarket-design YouTube Showcase
  • Medium 4.3
    CVE-2025-64248

    WordPress Request a Quote plugin <= 2.5.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in emarket-design Request a Quote request-a-quote allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Request a Quote: from n/a through <= 2.5.3.

    emarket-design Request a Quote
  • Medium 4.3
    CVE-2025-13403

    Employee Spotlight – Team Member Showcase & Meet the Team Plugin <= 5.1.3 - Missing Authorization to Authenticated (Subscriber+) Tracking Opt-In/Opt-Out Modification

    The Employee Spotlight – Team Member Showcase & Meet the Team Plugin for WordPress is vulnerable to unauthorized tracking settings modification due to missing authorization validation on the employee_spotlight_check_optin() function in all versions up to, and…

    emarket-design Employee Spotlight – Team Member Showcase & Meet the Team Plugin Web / CMS
  • Medium 6.4
    CVE-2025-12090

    Employee Spotlight – Team Member Showcase & Meet the Team Plugin <= 5.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Employee Spotlight – Team Member Showcase & Meet the Team Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Social URLs in all versions up to, and including, 5.1.2 due to insufficient input sanitization and output escaping. This…

    emarket-design Employee Spotlight – Team Member Showcase & Meet the Team Plugin Web / CMS
  • Medium 6.5
    CVE-2025-60157

    WordPress WP Ticket Customer Service Software & Support Ticket System Plugin <= 6.0.2 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in emarket-design WP Ticket Customer Service Software & Support Ticket System wp-ticket allows Stored XSS.This issue affects WP Ticket Customer Service Software…

    emarket-design WP Ticket Customer Service Software & Support Ticket System
  • Medium 6.5
    CVE-2025-58915

    WordPress Request a Quote plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in emarket-design Request a Quote request-a-quote allows Stored XSS.This issue affects Request a Quote: from n/a through <= 2.5.0.

    emarket-design Request a Quote
  • Medium 6.4
    CVE-2025-8314

    Software Issue Manager <= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via noaccess_msg Parameter

    The Software Issue Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg parameter in all versions up to, and including, 5.0.1 due to insufficient input sanitization and output escaping. This makes it possible for aut…

    emarket-design Project Management, Bug and Issue Tracking Plugin – Software Issue Manager Web / CMS
  • Medium 6.4
    CVE-2025-8295

    Employee Directory <= 4.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via noaccess_msg Parameter

    The Employee Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg’ parameter in all versions up to, and including, 4.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authen…

    emarket-design Employee Directory – Staff & Team Directory Web / CMS
  • Medium 6.4
    CVE-2025-8313

    Campus Directory <= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via noaccess_msg Parameter

    The Campus Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg’ parameter in all versions up to, and including, 1.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenti…

    emarket-design Campus Directory – Faculty, Staff & Student Directory Plugin for WordPress Web / CMS
  • Medium 6.4
    CVE-2025-8315

    WP Easy Contact <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via noaccess_msg Parameter

    The WP Easy Contact plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg’ parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authentic…

    emarket-design Simple Contact Form Plugin for WordPress – WP Easy Contact Web / CMS
  • Medium 6.4
    CVE-2025-5540

    Event RSVP and Simple Event Management Plugin <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Event RSVP and Simple Event Management Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emd_mb_meta' shortcode in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping…

    emarket-design Event RSVP and Simple Event Management Plugin Web / CMS
  • Medium 6.4
    CVE-2025-5539

    Simplify Contact Management: WP Easy Contact <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Simple Contact Form Plugin for WordPress – WP Easy Contact plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emd_mb_meta' shortcode in all versions up to, and including, 4.0.0 due to insufficient input sanitization and ou…

    emarket-design Simple Contact Form Plugin for WordPress – WP Easy Contact Web / CMS
  • Medium 6.4
    CVE-2025-5531

    Staff Directory – Employee Directory for WordPress <= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Employee Directory – Staff Listing & Team Directory Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emd_mb_meta' shortcode in all versions up to, and including, 4.5.0 due to insufficient input sanit…

    emarket-design Employee Directory – Staff & Team Directory Web / CMS
  • Medium 6.4
    CVE-2025-5532

    Faculty Staff and Student Directory Plugin – Campus Directory <= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Campus Directory – Faculty, Staff & Student Directory Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emd_mb_meta' shortcode in all versions up to, and including, 1.9.0 due to insufficient input san…

    emarket-design Campus Directory – Faculty, Staff & Student Directory Plugin for WordPress Web / CMS
  • Medium 5.3
    CVE-2024-3268

    YouTube Video Gallery by YouTube Showcase – Video Gallery Plugin for WordPress <= 3.3.6 - Missing Authorization to Arbitrary Post/Page Creation

    The YouTube Video Gallery by YouTube Showcase – Video Gallery Plugin for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the emd_form_builder_lite_submit_form function in all versions up t…

    emarket-design Video Gallery – YouTube Gallery & Responsive Video Playlist Web / CMS
  • Medium 5.4
    CVE-2023-40558

    WordPress Video Gallery & Management Plugin <= 3.3.5 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in eMarket Design YouTube Video Gallery by YouTube Showcase plugin <= 3.3.5 versions.

    emarket-design YouTube Video Gallery by YouTube Showcase