Skip to content
CVE PROGRAM SOURCE RECORD8.1 High

CVE-2025-8420

Multiple Plugins by emarket-design <= Multiple Versions - Unauthenticated Limited Remote Code Execution

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Wordfence

Description

Multiple plugins for WordPress by emarket-design with the 'emd-form-builder-lite' package are vulnerable to Remote Code Execution in various versions via the emd_form_builder_lite_pagenum function. This is due to the plugin not properly validating user input before using it as a function name. This makes it possible for unauthenticated attackers to execute code on the server, however, parameters can not be passed to the functions called

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

emarket-design Campus Directory – Faculty, Staff & Student Directory Plugin for WordPress

Default version status: unaffected

  • 0 to ≤ 1.9.2affected

emarket-design Request a Quote Form Plugin – Price Quote Request Management Made Easy

Default version status: unaffected

  • 0 to ≤ 2.5.2affected

emarket-design Video Gallery – YouTube Gallery & Responsive Video Playlist

Default version status: unaffected

  • 0 to ≤ 3.5.2affected

emarket-design Simple Contact Form Plugin for WordPress – WP Easy Contact

Default version status: unaffected

  • 0 to ≤ 4.0.2affected

emarket-design Event RSVP and Simple Event Management Plugin

Default version status: unaffected

  • 0 to ≤ 4.2.1affected

cyberlord92 Employee Directory – Staff Directory and Listing

Default version status: unaffected

  • 0 to ≤ 4.5.2affected

emarket-design Project Management, Bug and Issue Tracking Plugin – Software Issue Manager

Default version status: unaffected

  • 0 to ≤ 5.0.0affected

emarket-design Customer Support Ticket System & Helpdesk Plugin for WordPress

Default version status: unaffected

  • 0 to ≤ 6.0.1affected

References