eMarket Design vulnerabilities
We track 10 vulnerabilities in eMarket Design products across 15 products. 10 are rated high or critical, and none are known to be exploited. The most recent was published on July 23, 2026.
Latest eMarket Design vulnerabilities
- 9.8 Critical severity
Customer Support Ticket System & Helpdesk: Improper Control of Generation of Code
The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection via the 'path' parameter in all versions up to, and including, 6.0.5 due to the use of dynamic function invocation on an attacker-controlled value with insuffici
- 7.5 High severity
Request a Quote – Quote Forms for Any…: Improper Neutralization of Special Elements in Output Used by a Downstream Component
The Request a Quote plugin for WordPress is vulnerable to Code Injection in versions up to, and including, 2.5.5 via the emd_delete_file AJAX action. This is due to the emd_delete_file() handler deriving a PHP function name from the attacker-controlled $_POST[
- 7.5 High severity
Video Gallery – YouTube Gallery, Playlist &…: Improper Control of Filename for Include/Require Statement in PHP Program
The Youtube Showcase plugin for WordPress is vulnerable to Arbitrary Function Call in versions up to and including 4.0.3. This is due to insufficient validation of the 'path' parameter in the emd_delete_file() AJAX handler in includes/common-functions.php. The
- 7.5 High severity
Customer Support Ticket System & Helpdesk: Improper Neutralization of Special Elements used in an SQL Command
The WP Ticket plugin for WordPress is vulnerable to SQL Injection via the WordPress search query parameter (`s`) in versions up to, and including, 6.0.4 The plugin hooks WordPress's `posts_request` filter with `wp_ticket_com_posts_request()`, which calls `emd_
- 8.1 High severity
YouTube Showcase: Improper Control of Generation of Code
Improper Control of Generation of Code ('Code Injection') vulnerability in emarket-design YouTube Showcase youtube-showcase allows Object Injection.This issue affects YouTube Showcase: from n/a through <= 3.5.1.
- 8.1 High severity
WP Ticket Customer Service Software & Support…: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in emarket-design WP Ticket Customer Service Software & Support Ticket System wp-ticket allows Object Injection.This issue affects WP Ticket Customer Service Software & Support Ticket System: from n/a through <=
- 8.1 High severity
Employee Spotlight: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in emarket-design Employee Spotlight employee-spotlight allows Object Injection.This issue affects Employee Spotlight: from n/a through <= 5.1.1.
- 8.1 High severity
WP Easy Contact: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in emarket-design WP Easy Contact wp-easy-contact allows Object Injection.This issue affects WP Easy Contact: from n/a through <= 4.0.1.
- 8.1 High severity
Employee Directory – Staff Listing & Team…: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in emarket-design Employee Directory – Staff Listing & Team Directory Plugin for WordPress employee-directory allows Object Injection.This issue affects Employee Directory – Staff Listing & Team Directory Plugin
- 8.1 High severity
Campus Directory – Faculty, Staff & Student…: Improper Neutralization of Directives in Dynamically Evaluated Code
Multiple plugins for WordPress by emarket-design with the 'emd-form-builder-lite' package are vulnerable to Remote Code Execution in various versions via the emd_form_builder_lite_pagenum function. This is due to the plugin not properly validating user input b