CVE-2025-8420
High
Description
Multiple plugins for WordPress by emarket-design with the 'emd-form-builder-lite' package are vulnerable to Remote Code Execution in various versions via the emd_form_builder_lite_pagenum function. This is due to the plugin not properly validating user input before using it as a function name. This makes it possible for unauthenticated attackers to execute code on the server, however, parameters can not be passed to the functions called
SeverityHigh
CVSS8.1
Exploit probability—
ProductCampus Directory – Faculty, Staff & Student Directory Plugin for WordPress
PublishedAug 6, 2025
First seenAug 6, 2025
Weakness typeCWE-95CWE-95
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| emarket-design Campus Directory – Faculty, Staff & Student Directory Plugin for WordPress | v ≤ 1.9.2 | — |
| emarket-design Request a Quote Form Plugin – Price Quote Request Management Made Easy | v ≤ 2.5.2 | — |
| emarket-design Video Gallery – YouTube Gallery & Responsive Video Playlist | v ≤ 3.5.2 | — |
| emarket-design Simple Contact Form Plugin for WordPress – WP Easy Contact | v ≤ 4.0.2 | — |
| emarket-design Event RSVP and Simple Event Management Plugin | v ≤ 4.2.1 | — |
| cyberlord92 Employee Directory – Staff Directory and Listing | v ≤ 4.5.2 | — |
| emarket-design Project Management, Bug and Issue Tracking Plugin – Software Issue Manager | v ≤ 5.0.0 | — |
| emarket-design Customer Support Ticket System & Helpdesk Plugin for WordPress | v ≤ 6.0.1 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.