Multiple Plugins by emarket-design <= Multiple Versions - Unauthenticated Limited Remote Code Execution
high
Multiple plugins for WordPress by emarket-design with the 'emd-form-builder-lite' package are vulnerable to Remote Code Execution in various versions via the emd_form_builder_lite_pagenum function. This is due to the plugin not properly validating user input before using it as a function name. This makes it possible fo...
- CVSS:
- 8.1
- Affected:
- up to 1.9.2
- Fixed in:
- 1.9.3
- Disclosed:
- Aug 5, 2025
CVE-2025-8420 on NVD →
Campus Directory <= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via noaccess_msg Parameter
medium
The Campus Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg’ parameter in all versions up to, and including, 1.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to...
- CVSS:
- 6.4
- Affected:
- up to 1.9.1
- Fixed in:
- 1.9.2
- Disclosed:
- Aug 4, 2025
CVE-2025-8313 on NVD →
Faculty Staff and Student Directory Plugin – Campus Directory <= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
medium
The Campus Directory – Faculty, Staff & Student Directory Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emd_mb_meta' shortcode in all versions up to, and including, 1.9.0 due to insufficient input sanitization and output escaping on user supplied attributes. Th...
- CVSS:
- 6.4
- Affected:
- up to 1.9.0
- Fixed in:
- 1.9.1
- Disclosed:
- Jun 3, 2025
CVE-2025-5532 on NVD →
Faculty Staff and Student Directory Plugin – Campus Directory <= 1.7.4 - Authenticated Stored Cross-Site Scripting
medium
The Faculty Staff and Student Directory Plugin – Campus Directory plugin for WordPress is vulnerable to authenticated stored cross-site scripting via several parameters found in versions up to and including 1.7.4.
- CVSS:
- 5.5
- Affected:
- up to 1.7.4
- Fixed in:
- 1.7.5
- Disclosed:
- Apr 5, 2022
Campus Directory – Faculty, Staff & Student Directory Plugin for WordPress [campus-directory] < 1.7.5
unknown
Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Campus Directory plugin (versions <= 1.7.4).
- Affected:
- up to 1.7.5
- Fixed in:
- 1.7.5
- Disclosed:
- Apr 5, 2022
Campus Directory – Faculty, Staff & Student Directory Plugin for WordPress [campus-directory] < 1.7.5
unknown
The Faculty Staff and Student Directory Plugin – Campus Directory plugin for WordPress is vulnerable to authenticated stored cross-site scripting via several parameters found in versions up to and including 1.7.4.
- Affected:
- up to 1.7.5
- Fixed in:
- 1.7.5
- Disclosed:
- Apr 5, 2022
Campus Directory – Faculty, Staff & Student Directory Plugin for WordPress [campus-directory] < 1.9.1
unknown
- Affected:
- up to 1.9.1
- Fixed in:
- 1.9.1
CVE-2025-5532 on NVD →
Campus Directory – Faculty, Staff & Student Directory Plugin for WordPress [campus-directory] < 1.9.2
unknown
- Affected:
- up to 1.9.2
- Fixed in:
- 1.9.2
CVE-2025-8313 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database