Vulnerabilities > Emarketdesign
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-10-03 | CVE-2023-40558 | Cross-Site Request Forgery (CSRF) vulnerability in Emarketdesign Youtube Video Gallery Cross-Site Request Forgery (CSRF) vulnerability in eMarket Design YouTube Video Gallery by YouTube Showcase plugin <= 3.3.5 versions. | 8.8 |
| 2022-07-25 | CVE-2022-2239 | Unspecified vulnerability in Emarketdesign Request a Quote The Request a Quote WordPress plugin before 2.3.9 does not sanitise and escape some of its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. | 4.8 |
| 2022-07-25 | CVE-2022-2240 | Improper Neutralization of Formula Elements in a CSV File vulnerability in Emarketdesign Request a Quote The Request a Quote WordPress plugin through 2.3.7 does not validate uploaded CSV files, allowing unauthenticated users to attach a malicious CSV file to a quote, which could lead to a CSV injection once an admin download and open it | 8.8 |
| 2022-07-17 | CVE-2022-2151 | Cross-site Scripting vulnerability in Emarketdesign Best Contact Management Software The Best Contact Management Software WordPress plugin through 3.7.3 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. | 4.8 |
| 2021-10-25 | CVE-2021-24489 | Cross-site Scripting vulnerability in Emarketdesign Request a Quote The Request a Quote WordPress plugin before 2.3.9 does not sanitise, validate or escape some of its settings in the admin dashboard, leading to authenticated Stored Cross-Site Scripting issues even when the unfiltered_html capability is disallowed. | 4.8 |
| 2021-10-18 | CVE-2021-24622 | Cross-site Scripting vulnerability in Emarketdesign Customer Service Software & Support Ticket System The Customer Service Software & Support Ticket System WordPress plugin before 5.10.4 does not sanitize or escape form fields before outputting it in the List, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. | 4.8 |
| 2021-07-12 | CVE-2021-24420 | Cross-site Scripting vulnerability in Emarketdesign Request a Quote The Request a Quote WordPress plugin before 2.3.4 did not sanitise and escape some of its quote fields when adding/editing a quote as admin, leading to Stored Cross-Site scripting issues when the quote is output in the 'All Quotes" table. | 5.4 |