CVE-2025-8420highCWE-95

CVE-2025-8420: falha de alta gravidade em cyberlord92 Employee Directory – Staff…

Multiple Plugins by emarket-design <= Multiple Versions - Unauthenticated Limited Remote Code Execution

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Campus Directory – Faculty, Staff & Student Directory Plugin for WordPress+ Monitorar Simple Contact Form Plugin for WordPress – WP Easy Contact

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.1epss 1.2%
Multiple plugins for WordPress by emarket-design with the 'emd-form-builder-lite' package are vulnerable to Remote Code Execution in various versions via the emd_form_builder_lite_pagenum function. This is due to the plugin not properly validating user input before using it as a function name. This makes it possible for unauthenticated attackers to execute code on the server, however, parameters can not be passed to the functions called
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
cyberlord92 · Employee Directory – Staff Directory and Listingemarket-design · Campus Directory – Faculty, Staff & Student Directory Plugin for WordPressemarket-design · Customer Support Ticket System & Helpdesk Plugin for WordPressemarket-design · Event RSVP and Simple Event Management Pluginemarket-design · Project Management, Bug and Issue Tracking Plugin – Software Issue Manageremarket-design · Request a Quote Form Plugin – Price Quote Request Management Made Easyemarket-design · Simple Contact Form Plugin for WordPress – WP Easy Contactemarket-design · Video Gallery – YouTube Gallery & Responsive Video Playlist
CVEs relacionadas — cyberlord92 Employee Directory – Staff…

No mesmo produto, das mais perigosas para as menos.

CVE-2025-8313MEDIUMCampus Directory <= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via noaccess_msg ParameterEPSS 0.3%CVE-2026-1279MEDIUMEmployee Directory <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form_title' Shortcode AttributeEPSS 0.3%CVE-2025-5532MEDIUMFaculty Staff and Student Directory Plugin – Campus Directory <= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.2%