Emarket Design
Monthly
Code injection in the emarket-design Customer Support Ticket System & Helpdesk (WP-Ticket) WordPress plugin, versions up to and including 6.0.5, lets unauthenticated visitors invoke arbitrary parameterless PHP functions through the 'path' parameter, enabling information disclosure or denial of site functionality. Exploitation is reachable without login because the required WordPress nonce is publicly emitted via wp_localize_script wherever the [emd_form] shortcode is rendered, neutralizing the nonce as an access control. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the Wordfence-assigned CVSS is 9.8; the practical impact is narrower than that score because only functions taking no arguments can be called.
Arbitrary zero-argument PHP function invocation in the Youtube Showcase (Video Gallery - YouTube Gallery, Playlist & Video Grid) plugin for WordPress affects all versions up to and including 4.0.3, letting authenticated Subscriber-level users abuse the emd_delete_file() AJAX handler to call any callable PHP function name with no arguments. Because the handler validates only a nonce and omits a current_user_can() capability check, low-privileged accounts can trigger functions such as phpinfo(), get_defined_vars(), or error_get_last() to disclose sensitive server and application data. No public exploit identified at time of analysis and the issue is not in CISA KEV, so risk is currently theoretical but credible given the low privilege bar.
SQL injection in the WP Ticket WordPress plugin (versions up to and including 6.0.4) allows unauthenticated remote attackers to inject arbitrary SQL via the WordPress front-end search query parameter `s`, enabling extraction of sensitive database contents. The flaw stems from concatenating the unslashed search term into a UNION sub-SELECT without using `$wpdb->prepare()`. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the unauthenticated network attack vector keeps risk meaningful on exposed sites.
Stored Cross-Site Scripting in the YouTube Showcase WordPress plugin (versions up to and including 4.0.4) allows authenticated attackers with Author-level access to inject persistent malicious scripts via the `emd_mb_meta` shortcode. The flaw originates in two helper methods: `EMD_MB_Helper::image_info()` at helpers.php:L72 returns a raw, unsanitized attachment `post_title`, which `EMD_MB_Helper::shortcode()` at helpers.php:L274 then interpolates directly into an HTML `title` attribute using `sprintf()` without calling WordPress's standard `esc_attr()` function. No public exploit code or CISA KEV listing has been identified at time of analysis, but the scope-changed CVSS vector and the relatively low Author-level access bar make this an actionable patch priority for multi-author WordPress deployments.
Stored cross-site scripting in Emarket-design's YouTube Showcase WordPress plugin up to version 3.5.1 allows authenticated attackers to inject malicious scripts that execute in the context of other users' browsers. No active exploitation or public exploit code has been reported, and EPSS indicates a low 0.03% probability of exploitation over the next 30 days. The vulnerability carries a medium CVSS 6.5 score and requires low-privilege access and user interaction.
Code injection in the emarket-design Customer Support Ticket System & Helpdesk (WP-Ticket) WordPress plugin, versions up to and including 6.0.5, lets unauthenticated visitors invoke arbitrary parameterless PHP functions through the 'path' parameter, enabling information disclosure or denial of site functionality. Exploitation is reachable without login because the required WordPress nonce is publicly emitted via wp_localize_script wherever the [emd_form] shortcode is rendered, neutralizing the nonce as an access control. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the Wordfence-assigned CVSS is 9.8; the practical impact is narrower than that score because only functions taking no arguments can be called.
Arbitrary zero-argument PHP function invocation in the Youtube Showcase (Video Gallery - YouTube Gallery, Playlist & Video Grid) plugin for WordPress affects all versions up to and including 4.0.3, letting authenticated Subscriber-level users abuse the emd_delete_file() AJAX handler to call any callable PHP function name with no arguments. Because the handler validates only a nonce and omits a current_user_can() capability check, low-privileged accounts can trigger functions such as phpinfo(), get_defined_vars(), or error_get_last() to disclose sensitive server and application data. No public exploit identified at time of analysis and the issue is not in CISA KEV, so risk is currently theoretical but credible given the low privilege bar.
SQL injection in the WP Ticket WordPress plugin (versions up to and including 6.0.4) allows unauthenticated remote attackers to inject arbitrary SQL via the WordPress front-end search query parameter `s`, enabling extraction of sensitive database contents. The flaw stems from concatenating the unslashed search term into a UNION sub-SELECT without using `$wpdb->prepare()`. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the unauthenticated network attack vector keeps risk meaningful on exposed sites.
Stored Cross-Site Scripting in the YouTube Showcase WordPress plugin (versions up to and including 4.0.4) allows authenticated attackers with Author-level access to inject persistent malicious scripts via the `emd_mb_meta` shortcode. The flaw originates in two helper methods: `EMD_MB_Helper::image_info()` at helpers.php:L72 returns a raw, unsanitized attachment `post_title`, which `EMD_MB_Helper::shortcode()` at helpers.php:L274 then interpolates directly into an HTML `title` attribute using `sprintf()` without calling WordPress's standard `esc_attr()` function. No public exploit code or CISA KEV listing has been identified at time of analysis, but the scope-changed CVSS vector and the relatively low Author-level access bar make this an actionable patch priority for multi-author WordPress deployments.
Stored cross-site scripting in Emarket-design's YouTube Showcase WordPress plugin up to version 3.5.1 allows authenticated attackers to inject malicious scripts that execute in the context of other users' browsers. No active exploitation or public exploit code has been reported, and EPSS indicates a low 0.03% probability of exploitation over the next 30 days. The vulnerability carries a medium CVSS 6.5 score and requires low-privilege access and user interaction.