# cve.now: Emarket-design

The newest entries naming Emarket-design as an affected vendor (up to 200), of 28 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-61995](https://cve.now/CVE-2026-61995.md): WordPress YouTube Showcase plugin \<= 4.1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-15790](https://cve.now/CVE-2026-15790.md): Video Gallery \<= 4.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment 'post\_title' via emd\_mb\_meta Shortcode (CVSS 6.4)
- [CVE-2026-15011](https://cve.now/CVE-2026-15011.md): Customer Support Ticket System & Helpdesk \<= 6.0.5 - Unauthenticated Code Injection via 'path' Parameter (CVSS 9.8)
- [CVE-2026-14249](https://cve.now/CVE-2026-14249.md): Request a Quote Form Plugin \<= 2.5.5 - Unauthenticated Code Injection via 'path' Parameter (CVSS 7.5)
- [CVE-2026-12923](https://cve.now/CVE-2026-12923.md): Video Gallery \<= 4.0.3 - Authenticated (Subscriber+) Arbitrary Function Call via 'path' Parameter (CVSS 7.5)
- [CVE-2026-9848](https://cve.now/CVE-2026-9848.md): WP Ticket \<= 6.0.4 - Unauthenticated SQL Injection via WordPress Search 's' Parameter (CVSS 7.5)
- [CVE-2025-15636](https://cve.now/CVE-2025-15636.md): WordPress YouTube Showcase plugin \<= 3.5.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-64248](https://cve.now/CVE-2025-64248.md): WordPress Request a Quote plugin \<= 2.5.3 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2025-13403](https://cve.now/CVE-2025-13403.md): Employee Spotlight – Team Member Showcase & Meet the Team Plugin \<= 5.1.3 - Missing Authorization to Authenticated (Subscriber+) Tracking Opt-In/Opt-Out Modification (CVSS 4.3)
- [CVE-2025-12090](https://cve.now/CVE-2025-12090.md): Employee Spotlight – Team Member Showcase & Meet the Team Plugin \<= 5.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2025-60157](https://cve.now/CVE-2025-60157.md): WordPress WP Ticket Customer Service Software & Support Ticket System Plugin \<= 6.0.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-58915](https://cve.now/CVE-2025-58915.md): WordPress Request a Quote plugin \<= 2.5.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-54731](https://cve.now/CVE-2025-54731.md): WordPress YouTube Showcase Plugin \<= 3.5.1 - PHP Object Injection Vulnerability (CVSS 8.1)
- [CVE-2025-53584](https://cve.now/CVE-2025-53584.md): WordPress WP Ticket Customer Service Software & Support Ticket System Plugin \<= 6.0.2 - PHP Object Injection Vulnerability (CVSS 8.1)
- [CVE-2025-53583](https://cve.now/CVE-2025-53583.md): WordPress Employee Spotlight Plugin \<= 5.1.1 - PHP Object Injection Vulnerability (CVSS 8.1)
- [CVE-2025-53572](https://cve.now/CVE-2025-53572.md): WordPress WP Easy Contact Plugin \<= 4.0.1 - PHP Object Injection Vulnerability (CVSS 8.1)
- [CVE-2025-53243](https://cve.now/CVE-2025-53243.md): WordPress Employee Directory – Staff Listing & Team Directory plugin for WordPress plugin \<= 4.5.5 - PHP Object Injection vulnerability (CVSS 8.1)
- [CVE-2025-8314](https://cve.now/CVE-2025-8314.md): Software Issue Manager \<= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via noaccess\_msg Parameter (CVSS 6.4)
- [CVE-2025-8420](https://cve.now/CVE-2025-8420.md): Multiple Plugins by emarket-design \<= Multiple Versions - Unauthenticated Limited Remote Code Execution (CVSS 8.1)
- [CVE-2025-8295](https://cve.now/CVE-2025-8295.md): Employee Directory \<= 4.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via noaccess\_msg Parameter (CVSS 6.4)
- [CVE-2025-8313](https://cve.now/CVE-2025-8313.md): Campus Directory \<= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via noaccess\_msg Parameter (CVSS 6.4)
- [CVE-2025-8315](https://cve.now/CVE-2025-8315.md): WP Easy Contact \<= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via noaccess\_msg Parameter (CVSS 6.4)
- [CVE-2025-5540](https://cve.now/CVE-2025-5540.md): Event RSVP and Simple Event Management Plugin \<= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2025-5539](https://cve.now/CVE-2025-5539.md): Simplify Contact Management: WP Easy Contact \<= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2025-5532](https://cve.now/CVE-2025-5532.md): Faculty Staff and Student Directory Plugin – Campus Directory \<= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2025-5531](https://cve.now/CVE-2025-5531.md): Staff Directory – Employee Directory for WordPress \<= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-3268](https://cve.now/CVE-2024-3268.md): YouTube Video Gallery by YouTube Showcase – Video Gallery Plugin for WordPress \<= 3.3.6 - Missing Authorization to Arbitrary Post/Page Creation (CVSS 5.3)
- [CVE-2023-40558](https://cve.now/CVE-2023-40558.md): WordPress Video Gallery & Management Plugin \<= 3.3.5 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/emarket-design
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.