Emarket-design vulnerabilities
28 CVEs and advisories name Emarket-design as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-61995WordPress YouTube Showcase plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-15790Video Gallery <= 4.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment 'post_title' via emd_mb_meta Shortcode
- CVE-2026-15011Customer Support Ticket System & Helpdesk <= 6.0.5 - Unauthenticated Code Injection via 'path' Parameter
- CVE-2026-14249Request a Quote Form Plugin <= 2.5.5 - Unauthenticated Code Injection via 'path' Parameter
- CVE-2026-12923Video Gallery <= 4.0.3 - Authenticated (Subscriber+) Arbitrary Function Call via 'path' Parameter
- CVE-2026-9848WP Ticket <= 6.0.4 - Unauthenticated SQL Injection via WordPress Search 's' Parameter
- CVE-2025-15636WordPress YouTube Showcase plugin <= 3.5.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2025-64248WordPress Request a Quote plugin <= 2.5.3 - Broken Access Control vulnerability
- CVE-2025-13403Employee Spotlight – Team Member Showcase & Meet the Team Plugin <= 5.1.3 - Missing Authorization to Authenticated (Subscriber+) Tracking Opt-In/Opt-Out Modification
- CVE-2025-12090Employee Spotlight – Team Member Showcase & Meet the Team Plugin <= 5.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2025-60157WordPress WP Ticket Customer Service Software & Support Ticket System Plugin <= 6.0.2 - Cross Site Scripting (XSS) Vulnerability
- CVE-2025-58915WordPress Request a Quote plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2025-54731WordPress YouTube Showcase Plugin <= 3.5.1 - PHP Object Injection Vulnerability
- CVE-2025-53584WordPress WP Ticket Customer Service Software & Support Ticket System Plugin <= 6.0.2 - PHP Object Injection Vulnerability
- CVE-2025-53583WordPress Employee Spotlight Plugin <= 5.1.1 - PHP Object Injection Vulnerability
- CVE-2025-53572WordPress WP Easy Contact Plugin <= 4.0.1 - PHP Object Injection Vulnerability
- CVE-2025-53243WordPress Employee Directory – Staff Listing & Team Directory plugin for WordPress plugin <= 4.5.5 - PHP Object Injection vulnerability
- CVE-2025-8314Software Issue Manager <= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via noaccess_msg Parameter
- CVE-2025-8420Multiple Plugins by emarket-design <= Multiple Versions - Unauthenticated Limited Remote Code Execution
- CVE-2025-8295Employee Directory <= 4.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via noaccess_msg Parameter
- CVE-2025-8313Campus Directory <= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via noaccess_msg Parameter
- CVE-2025-8315WP Easy Contact <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via noaccess_msg Parameter
- CVE-2025-5540Event RSVP and Simple Event Management Plugin <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2025-5539Simplify Contact Management: WP Easy Contact <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2025-5532Faculty Staff and Student Directory Plugin – Campus Directory <= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2025-5531Staff Directory – Employee Directory for WordPress <= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-3268YouTube Video Gallery by YouTube Showcase – Video Gallery Plugin for WordPress <= 3.3.6 - Missing Authorization to Arbitrary Post/Page Creation
- CVE-2023-40558WordPress Video Gallery & Management Plugin <= 3.3.5 is vulnerable to Cross Site Request Forgery (CSRF)