Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2025-8420

Multiple plugins for WordPress by emarket-design with the 'emd-form-builder-lite' package are vulnerable to Remote Code Execution in various versions via the emd_form_builder_lite_pagenum function. This is due to the plugin not properly validating user input before using it as a function name. This makes it possible for unauthenticated attackers to execute code on the server, however, parameters can not be passed to the functions called
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:f1da744499911416e258dd29141ab223427acfff076695ce4dbba332744952aa
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 8 assertions

{"defaultStatus":"unaffected","product":"Campus Directory – Faculty, Staff & Student Directory Plugin for WordPress","vendor":"emarket-design","versions":[{"lessThanOrEqual":"1.9.2","status":"affected","version":"0","versionType":"semver"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:d406242595fb5bec9b20eddcbef1277e33c71739a180af3b933e8d703765b503 · sha256:bbc99e60370490f0… · /containers/cna/affected/0

{"defaultStatus":"unaffected","product":"Request a Quote Form Plugin – Price Quote Request Management Made Easy","vendor":"emarket-design","versions":[{"lessThanOrEqual":"2.5.2","status":"affected","version":"0","versionType":"semver"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:d406242595fb5bec9b20eddcbef1277e33c71739a180af3b933e8d703765b503 · sha256:bbc99e60370490f0… · /containers/cna/affected/1

{"defaultStatus":"unaffected","product":"Employee Directory – Staff Directory and Listing","vendor":"cyberlord92","versions":[{"lessThanOrEqual":"4.5.2","status":"affected","version":"0","versionType":"semver"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:d406242595fb5bec9b20eddcbef1277e33c71739a180af3b933e8d703765b503 · sha256:bbc99e60370490f0… · /containers/cna/affected/5

{"defaultStatus":"unaffected","product":"Video Gallery – YouTube Gallery & Responsive Video Playlist","vendor":"emarket-design","versions":[{"lessThanOrEqual":"3.5.2","status":"affected","version":"0","versionType":"semver"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:d406242595fb5bec9b20eddcbef1277e33c71739a180af3b933e8d703765b503 · sha256:bbc99e60370490f0… · /containers/cna/affected/2

{"defaultStatus":"unaffected","product":"Simple Contact Form Plugin for WordPress – WP Easy Contact","vendor":"emarket-design","versions":[{"lessThanOrEqual":"4.0.2","status":"affected","version":"0","versionType":"semver"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:d406242595fb5bec9b20eddcbef1277e33c71739a180af3b933e8d703765b503 · sha256:bbc99e60370490f0… · /containers/cna/affected/3

{"defaultStatus":"unaffected","product":"Project Management, Bug and Issue Tracking Plugin – Software Issue Manager","vendor":"emarket-design","versions":[{"lessThanOrEqual":"5.0.0","status":"affected","version":"0","versionType":"semver"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:d406242595fb5bec9b20eddcbef1277e33c71739a180af3b933e8d703765b503 · sha256:bbc99e60370490f0… · /containers/cna/affected/6

{"defaultStatus":"unaffected","product":"Event RSVP and Simple Event Management Plugin","vendor":"emarket-design","versions":[{"lessThanOrEqual":"4.2.1","status":"affected","version":"0","versionType":"semver"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:d406242595fb5bec9b20eddcbef1277e33c71739a180af3b933e8d703765b503 · sha256:bbc99e60370490f0… · /containers/cna/affected/4

{"defaultStatus":"unaffected","product":"Customer Support Ticket System & Helpdesk Plugin for WordPress","vendor":"emarket-design","versions":[{"lessThanOrEqual":"6.0.1","status":"affected","version":"0","versionType":"semver"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:d406242595fb5bec9b20eddcbef1277e33c71739a180af3b933e8d703765b503 · sha256:bbc99e60370490f0… · /containers/cna/affected/7

Affected products and versions

8 source assertions
{"defaultStatus":"unaffected","product":"Campus Directory – Faculty, Staff & Student Directory Plugin for WordPress","vendor":"emarket-design","versions":[{"lessThanOrEqual":"1.9.2","status":"affected","version":"0","versionType":"semver"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:d406242595fb5bec9b20eddcbef1277e33c71739a180af3b933e8d703765b503 · sha256:bbc99e60370490f0… · /containers/cna/affected/0
{"defaultStatus":"unaffected","product":"Request a Quote Form Plugin – Price Quote Request Management Made Easy","vendor":"emarket-design","versions":[{"lessThanOrEqual":"2.5.2","status":"affected","version":"0","versionType":"semver"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:d406242595fb5bec9b20eddcbef1277e33c71739a180af3b933e8d703765b503 · sha256:bbc99e60370490f0… · /containers/cna/affected/1
{"defaultStatus":"unaffected","product":"Employee Directory – Staff Directory and Listing","vendor":"cyberlord92","versions":[{"lessThanOrEqual":"4.5.2","status":"affected","version":"0","versionType":"semver"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:d406242595fb5bec9b20eddcbef1277e33c71739a180af3b933e8d703765b503 · sha256:bbc99e60370490f0… · /containers/cna/affected/5
{"defaultStatus":"unaffected","product":"Video Gallery – YouTube Gallery & Responsive Video Playlist","vendor":"emarket-design","versions":[{"lessThanOrEqual":"3.5.2","status":"affected","version":"0","versionType":"semver"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:d406242595fb5bec9b20eddcbef1277e33c71739a180af3b933e8d703765b503 · sha256:bbc99e60370490f0… · /containers/cna/affected/2
{"defaultStatus":"unaffected","product":"Simple Contact Form Plugin for WordPress – WP Easy Contact","vendor":"emarket-design","versions":[{"lessThanOrEqual":"4.0.2","status":"affected","version":"0","versionType":"semver"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:d406242595fb5bec9b20eddcbef1277e33c71739a180af3b933e8d703765b503 · sha256:bbc99e60370490f0… · /containers/cna/affected/3
{"defaultStatus":"unaffected","product":"Project Management, Bug and Issue Tracking Plugin – Software Issue Manager","vendor":"emarket-design","versions":[{"lessThanOrEqual":"5.0.0","status":"affected","version":"0","versionType":"semver"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:d406242595fb5bec9b20eddcbef1277e33c71739a180af3b933e8d703765b503 · sha256:bbc99e60370490f0… · /containers/cna/affected/6
{"defaultStatus":"unaffected","product":"Event RSVP and Simple Event Management Plugin","vendor":"emarket-design","versions":[{"lessThanOrEqual":"4.2.1","status":"affected","version":"0","versionType":"semver"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:d406242595fb5bec9b20eddcbef1277e33c71739a180af3b933e8d703765b503 · sha256:bbc99e60370490f0… · /containers/cna/affected/4
{"defaultStatus":"unaffected","product":"Customer Support Ticket System & Helpdesk Plugin for WordPress","vendor":"emarket-design","versions":[{"lessThanOrEqual":"6.0.1","status":"affected","version":"0","versionType":"semver"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:d406242595fb5bec9b20eddcbef1277e33c71739a180af3b933e8d703765b503 · sha256:bbc99e60370490f0… · /containers/cna/affected/7

Provider-owned CVSS observations

1 source assertion
{"metric":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:d406242595fb5bec9b20eddcbef1277e33c71739a180af3b933e8d703765b503 · sha256:bbc99e60370490f0… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion
{"cweId":"CWE-95","description":"CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:d406242595fb5bec9b20eddcbef1277e33c71739a180af3b933e8d703765b503 · sha256:bbc99e60370490f0… · /containers/cna/problemTypes/0/descriptions/0

Source references

9 source assertions
{"url":"https://plugins.trac.wordpress.org/changeset/3346435/"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:d406242595fb5bec9b20eddcbef1277e33c71739a180af3b933e8d703765b503 · sha256:bbc99e60370490f0… · /containers/cna/references/4
{"url":"https://plugins.trac.wordpress.org/changeset/3346460/"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:d406242595fb5bec9b20eddcbef1277e33c71739a180af3b933e8d703765b503 · sha256:bbc99e60370490f0… · /containers/cna/references/5
{"url":"https://plugins.trac.wordpress.org/changeset/3347084/"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:d406242595fb5bec9b20eddcbef1277e33c71739a180af3b933e8d703765b503 · sha256:bbc99e60370490f0… · /containers/cna/references/6
{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3338854%40request-a-quote&new=3338854%40request-a-quote&sfp_email=&sfph_mail="}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:d406242595fb5bec9b20eddcbef1277e33c71739a180af3b933e8d703765b503 · sha256:bbc99e60370490f0… · /containers/cna/references/1
{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3340992%40software-issue-manager&new=3340992%40software-issue-manager&sfp_email=&sfph_mail="}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:d406242595fb5bec9b20eddcbef1277e33c71739a180af3b933e8d703765b503 · sha256:bbc99e60370490f0… · /containers/cna/references/2
{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3341064%40wp-ticket&new=3341064%40wp-ticket&sfp_email=&sfph_mail="}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:d406242595fb5bec9b20eddcbef1277e33c71739a180af3b933e8d703765b503 · sha256:bbc99e60370490f0… · /containers/cna/references/3
{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3348220%40wp-easy-events&new=3348220%40wp-easy-events&sfp_email=&sfph_mail="}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:d406242595fb5bec9b20eddcbef1277e33c71739a180af3b933e8d703765b503 · sha256:bbc99e60370490f0… · /containers/cna/references/7
{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3365190%40youtube-showcase&new=3365190%40youtube-showcase&sfp_email=&sfph_mail="}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:d406242595fb5bec9b20eddcbef1277e33c71739a180af3b933e8d703765b503 · sha256:bbc99e60370490f0… · /containers/cna/references/8
{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/601aa2b5-aeac-49bc-960d-4b4ff83e9229?source=cve"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:d406242595fb5bec9b20eddcbef1277e33c71739a180af3b933e8d703765b503 · sha256:bbc99e60370490f0… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer