CVE-2025-58915
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The Request a Quote plugin for WordPress (from emarket-design) contains a Stored XSS vulnerability in versions up to and including 2.5.0. Improper neutralization of input during web page generation allows persistent script injection.
Risk Assessment
An attacker could inject a persistent script that executes every time the page is viewed, potentially leading to data theft, session hijacking, or malware distribution.
Recommendation
Update the Request a Quote plugin to the latest version that includes a fix eliminating the XSS vulnerability.
Other vulnerabilities in Request a Quote
See all- CVE-2026-90988Medium
The Request a Quote WordPress plugin through 2.5.6 does not perform an authorization check on one of its unauthenticated AJAX handlers, allowing unauthenticated users to read the contact records of quote-request submissions, including records the site has not published.
- CVE-2026-14249High
The Request a Quote plugin for WordPress up to version 2.5.5 is vulnerable to Code Injection via the emd_delete_file AJAX action. An unauthenticated attacker can invoke arbitrary zero-argument PHP functions, such as phpinfo(), by manipulating the $_POST['path'] parameter.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in emarket-design Request a Quote request-a-quote allows Stored XSS.This issue affects Request a Quote: from n/a through <= 2.5.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS