vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2025-8420

Multiple Plugins by emarket-design <= Multiple Versions - Unauthenticated Limited Remote Code Execution

HIGH
8.1
CVSS Score
Published: August 6, 2025 at 02:24 AM UTC
Updated: June 17, 2026 at 10:06 AM UTC
8 products affected across 2 vendorsRequest a QuoteYouTube Video GalleryCustomer Service Software & Support Ticket System

Using Request a Quote Form Plugin – Price Quote Request Management Made Easy by emarket-design?

Get instant alerts when new vulnerabilities affect Request a Quote Form Plugin – Price Quote Request Management Made Easy - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH8.1
Exploit prediction
EPSS 1%
SSVC
No known exploit

Description

The Request a Quote Form plugin for WordPress is vulnerable to Remote Code Execution in version less than, or equal to, 2.5.2 via the emd_form_builder_lite_pagenum function. This is due to the plugin not properly validating user input before using it as a function name. This makes it possible for unauthenticated attackers to execute code on the server, however, parameters can not be passed to the functions called.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Employee Directory· CYBERLORD92wordpress-plugin
60%
v ≤ 4.5.2
Campus Directory· Emarketdesignwordpress-plugin
60%
v ≤ 1.9.2
Customer Service Software & Support Ticket System· Emarketdesignwordpress-plugin
60%
v ≤ 6.0.1
Event Rsvp and Simple Event Management· Emarketdesignwordpress-plugin
60%
v ≤ 4.2.1
Request a Quote· Emarketdesignwordpress-plugin
60%
v ≤ 2.5.2
Software Issue Manager· Emarketdesignwordpress-plugin
60%
v ≤ 5.0.0
WP Easy Contact· Emarketdesignwordpress-plugin
60%
v ≤ 4.0.2
YouTube Video Gallery· Emarketdesignwordpress-plugin
60%
v ≤ 3.5.2

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (9)

Source: [email protected]
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3338854%40request-a-quote&new=3338854%40request-a-quote&sfp_email=&sfph_mail=
Source: [email protected]
https://www.wordfence.com/threat-intel/vulnerabilities/id/601aa2b5-aeac-49bc-960d-4b4ff83e9229?source=cve
Source: cverecord
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3340992%40software-issue-manager&new=3340992%40software-issue-manager&sfp_email=&sfph_mail=
Source: cverecord
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3341064%40wp-ticket&new=3341064%40wp-ticket&sfp_email=&sfph_mail=
Source: cverecord
https://plugins.trac.wordpress.org/changeset/3346435/
Source: cverecord
https://plugins.trac.wordpress.org/changeset/3346460/
Source: cverecord
https://plugins.trac.wordpress.org/changeset/3347084/
Source: cverecord
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3348220%40wp-easy-events&new=3348220%40wp-easy-events&sfp_email=&sfph_mail=

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

8.1HIGHWordfence
Vector?

Quick Info

StatusDEFERRED
CWE
CWE-95

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card