Extension WordPress
Vulnérabilités Request a Quote – Quote Forms for Any WordPress Site
Cette page rassemble les failles publiées pour Request a Quote – Quote Forms for Any WordPress Site, leurs plages de versions affectées et les correctifs signalés dans la base locale.
Historique de sécurité
CVE et vulnérabilités de Request a Quote – Quote Forms for Any WordPress Site
10 fiches
Request a Quote Form Plugin <= 2.5.5 – Unauthenticated Code Injection via 'path' Parameter
The Request a Quote plugin for WordPress is vulnerable to Code Injection in versions up to, and including, 2.5.5 via the emd_delete_file AJAX action. This is due to the emd_delete_file() handler deriving a PHP function name from the…
*-2.5.5
2.5.6
01/07/2026
Request a Quote <= 2.5.3 – Missing Authorization
The Request a Quote Form Plugin – Price Quote Request Management Made Easy plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.5.3.…
*-2.5.3
2.5.4
15/12/2025
Multiple Plugins by eMarket Design <= Various Versions – Authenticated (Contributor+) Stored Cross-Site Scripting
Multiple plugins for WordPress by by eMarket Design are vulnerable to Stored Cross-Site Scripting in various versions due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to…
*-2.5.0
2.5.1
23/09/2025
Multiple Plugins by emarket-design <= Multiple Versions – Unauthenticated Limited Remote Code Execution
Multiple plugins for WordPress by emarket-design with the 'emd-form-builder-lite' package are vulnerable to Remote Code Execution in various versions via the emd_form_builder_lite_pagenum function. This is due to the plugin not properly validating user input before using it as…
*-2.5.2
2.5.3
05/08/2025
Request a Quote <= 2.4.0 – Authenticated (Admin+) Stored Cross-Site Scripting
The Request a Quote plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated…
*-2.4.0
2.4.1
02/07/2024
Request a Quote <= 2.3.10 – Cross-Site Request Forgery
The Request a Quote plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.10. This is due to missing nonce validation on the emd_show_forms_lite_page() function. This makes it possible for unauthenticated attackers…
[*, 2.3.11)
2.3.11
30/06/2023
Request a Quote <= 2.3.8 – CSV Injection
The Request a Quote WordPress plugin through 2.3.8 does not validate uploaded CSV files, allowing unauthenticated users to attach a malicious CSV file to a quote, which could lead to a CSV injection once an admin download and…
*-2.3.8
2.3.9
28/06/2022
Request a Quote <= 2.3.7 – Authenticated (Admin+) Stored Cross-Site Scripting
The Request a Quote WordPress plugin through 2.3.7 does not sanitise and escape some of its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
*-2.3.7
2.3.8
28/06/2022
Request a Quote <= 2.3.4 – Stored Cross-Site Scripting
The Request a Quote WordPress plugin before 2.3.5 does not sanitise, validate or escape some of its settings in the admin dashboard, leading to authenticated Stored Cross-Site Scripting issues even when the unfiltered_html capability is disallowed.
[*, 2.3.5)
2.3.5
21/09/2021
Request a Quote <= 2.3.3 – Authenticated Stored Cross-Site Scripting
The Request a Quote WordPress plugin before 2.3.4 did not sanitise and escape some of its quote fields when adding/editing a quote as admin, leading to Stored Cross-Site scripting issues when the quote is output in the 'All…
[*, 2.3.4)
2.3.4
16/06/2021
Extensions également surveillés
WP Commander
Rechercher dans toute la base WordPress
Utilisez la recherche globale pour retrouver une extension, un thème, une CVE ou un identifiant de vulnérabilité.