Request a Quote – Quote Forms for Any WordPress Site

Request a Quote – Quote Forms for Any WordPress Site has 11 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2026; 10 are fixed and 1 remains unpatched as of October 2026. Their average CVSS score is 5.8, and the most serious one scores 8.3 out of 10. Severity breakdown: 0 critical and 3 high. 2025 was the busiest year with 3 disclosures.

The most common weakness is Cross-Site Scripting, behind 5 of the records (45%). Other recurring categories include Cross-Site Request Forgery (CSRF), Eval Injection.

10 of the records (91%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2026.

9 independent researchers contributed these findings, most of them (2) reported by Benachi.

Strategic Overview

Avg CVSSMedium

5.8/ 10

Patch Coverage91%

Open

Fixed

Get automatic notifications for all Request a Quote – Quote Forms for Any WordPress Site vulnerabilities before they are exploited.

Most severe open issueCVSS 5.3CVE-2026-90988

Request a Quote <= 2.5.6 - Unauthenticated Information Exposure

Read the full analysis

Vulnerability Records

11 records


2026-09-29 00:00	Request a Quote <= 2.5.6 - Unauthenticated Information Exposure Request a Quote <= 2.5.6	`CVE-2026-90988`	5.3 Medium	Artus KG	No
2026-07-01 16:53	Request a Quote Form Plugin <= 2.5.5 - Unauthenticated Code Injection via 'path' Parameter Request a Quote <= 2.5.5	`CVE-2026-14249`	7.5 High	Mitchell	Yes
2025-12-15 00:00	Request a Quote <= 2.5.3 - Missing Authorization Request a Quote <= 2.5.3	`CVE-2025-64248`	4.3 Medium	Legion Hunter	Yes
2025-09-23 00:00	Multiple Plugins by eMarket Design <= Various Versions - Authenticated (Contributor+) Stored Cross-Site Scripting Request a Quote <= 2.5.0	`CVE-2025-58915`	6.4 Medium	Muhammad Yudha - DJ	Yes
2025-08-05 13:47	Multiple Plugins by emarket-design <= Multiple Versions - Unauthenticated Limited Remote Code Execution Request a Quote <= 2.5.2	`CVE-2025-8420`	8.1 High	Michael Mazzolini	Yes
2024-07-02 00:00	Request a Quote <= 2.4.0 - Authenticated (Admin+) Stored Cross-Site Scripting Request a Quote <= 2.4.0	`CVE-2024-6231`	4.4 Medium	Bob Matyas	Yes
2023-06-30 00:00	Request a Quote <= 2.3.10 - Cross-Site Request Forgery Request a Quote < 2.3.11	`N/A`	4.3 Medium	Anonymous	Yes
2022-06-28 00:00	Request a Quote <= 2.3.7 - Authenticated (Admin+) Stored Cross-Site Scripting Request a Quote <= 2.3.7	`CVE-2022-2239`	5.5 Medium	Benachi	Yes
2022-06-28 00:00	Request a Quote <= 2.3.8 - CSV Injection Request a Quote <= 2.3.8	`CVE-2022-2240`	8.3 High	Benachi	Yes
2021-09-21 00:00	Request a Quote <= 2.3.4 - Stored Cross-Site Scripting Request a Quote < 2.3.5	`CVE-2021-24489`	4.8 Medium	YoshiKen	Yes

Showing 1–10 of 11 reports