Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?Request a QuoteYITH WooCommerce Request A QuoteELEX WooCommerce Request a QuoteDealia – Request a quoteyith-woocommerce-request-a-quote-premium
Plugin · request-a-quote
Request a Quote
10 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 2, 2026Request a Quote: Does not perform an authorization check on one of its unauthenticated AJAX handlersCVE-2026-90988 · affects up to 2.5.6 · reported by WPScanMedium 5.3
The Request a Quote WordPress plugin through 2.5.6 does not perform an authorization check on one of its unauthenticated AJAX handlers, allowing unauthenticated users to read the contact records of quote-request submissions, including records the site has not published.
Jul 2, 2026Request a Quote: Code InjectionCVE-2026-14249 · affects up to 2.5.5 · reported by WordfenceHigh 7.5
The Request a Quote plugin for WordPress is vulnerable to Code Injection in versions up to, and including, 2.5.5 via the emd_delete_file AJAX action. This is due to the emd_delete_file() handler deriving a PHP function name from the attacker-controlled $_POST['path'] parameter and invoking it dynamically via the variable-function call $sess_name(), and the handler being registered for wp_ajax_nopriv with its only protection being a nonce that the plugin prints into the public quote-form page via wp_localize_script. This makes it possible for unauthenticated attackers to invoke arbitrary zero-argument PHP functions on the server, such as phpinfo(), potentially exposing sensitive server configuration and credentials, or executing other destructive built-in PHP functions.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 16, 2025Request a Quote: Missing AuthorizationCVE-2025-64248 · affects up to 2.5.3 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in emarket-design Request a Quote request-a-quote allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Request a Quote: from n/a through <= 2.5.3.
Sep 22, 2025Request a Quote: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58915 · affects up to 2.5.0 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in emarket-design Request a Quote request-a-quote allows Stored XSS.This issue affects Request a Quote: from n/a through <= 2.5.0.
Aug 5, 2025Multiple plugins for WordPress by emarket-design with the 'emd-form-builder-lite' package are vulnerable to Remote Code Execution in various versions via the emCVE-2025-8420 · reported by WordfenceHigh 8.1
Multiple plugins for WordPress by emarket-design with the 'emd-form-builder-lite' package are vulnerable to Remote Code Execution in various versions via the emd_form_builder_lite_pagenum function. This is due to the plugin not properly validating user input before using it as a function name. This makes it possible for unauthenticated attackers to execute code on the server, however, parameters can not be passed to the functions called
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 23, 2024Request a Quote: Does not sanitise and escape some of its settingsCVE-2024-6231 · fixed in 2.4.1 · reported by WPScanMedium 5.9
The Request a Quote WordPress plugin before 2.4.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Jul 25, 2022Request a Quote: Does not validate uploaded CSV filesCVE-2022-2240 · affects up to 2.3.7 · reported by WPScanHigh 8.8
The Request a Quote WordPress plugin through 2.3.7 does not validate uploaded CSV files, allowing unauthenticated users to attach a malicious CSV file to a quote, which could lead to a CSV injection once an admin download and open it
Jul 25, 2022Request a Quote: Does not sanitise and escape some of its settingsCVE-2022-2239 · fixed in 2.3.9 · reported by WPScanMedium 4.8
The Request a Quote WordPress plugin before 2.3.9 does not sanitise and escape some of its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Oct 25, 2021Request a Quote: Does not sanitiseCVE-2021-24489 · fixed in 2.3.9 · reported by WPScanMedium 4.8
The Request a Quote WordPress plugin before 2.3.9 does not sanitise, validate or escape some of its settings in the admin dashboard, leading to authenticated Stored Cross-Site Scripting issues even when the unfiltered_html capability is disallowed.
Jul 12, 2021Request a Quote: Did not sanitise and escape some of its quote fieldsCVE-2021-24420 · fixed in 2.3.4 · reported by WPScanMedium 5.4
The Request a Quote WordPress plugin before 2.3.4 did not sanitise and escape some of its quote fields when adding/editing a quote as admin, leading to Stored Cross-Site scripting issues when the quote is output in the 'All Quotes" table.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.