Codepeople
77 CVEs across 41 Codepeople products. Browse Codepeople vulnerabilities, severities, and proof-of-concept exploits.
Codepeople products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-65514 | Medium | 6.5 | 2026-07-23 | Contributor Cross Site Scripting (XSS) in Appointment Hour Booking <= 1.5.86 versions. |
CVE-2026-57670 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Google Maps CP <= 1.2.5 versions. |
CVE-2026-12113 | Medium | 4.3 | 2026-07-01 | The Appointment Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.02 via the cpab… |
CVE-2026-13335 | Medium | 6.4 | 2026-06-27 | The CodePeople Post Map for Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cpm_point' Post Meta in all versions up to, and… |
CVE-2026-12111 | Medium | 4.3 | 2026-06-18 | The Appointment Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.4.01. This is due to… |
CVE-2026-48882 | High | 8.5 | 2026-06-15 | Subscriber SQL Injection in WP Time Slots Booking Form <= 1.2.50 versions. |
CVE-2026-40791 | High | 7.1 | 2026-06-15 | Unauthenticated Cross Site Scripting (XSS) in WP Time Slots Booking Form <= 1.2.46 versions. |
CVE-2026-6810 | Medium | 5.3 | 2026-04-24 | The Booking Calendar Contact Form plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.63 via the d… |
CVE-2026-32483 | Medium | 6.5 | 2026-03-25 | Missing Authorization vulnerability in codepeople Contact Form Email contact-form-to-email allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2026-25465 | Medium | 6.5 | 2026-03-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople CP Multi View Event Calendar cp-multi-view-ca… |
CVE-2026-3986 | Medium | 6.4 | 2026-03-13 | The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form settings in all versions up to, and including, 5.4.5… |
CVE-2026-32433 | High | 8.5 | 2026-03-13 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in codepeople CP Contact Form with Paypal cp-contact-form-wi… |
CVE-2026-32432 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in codepeople WP Time Slots Booking Form wp-time-slots-booking-form allows Exploiting Incorrectly Configured Access Control… |
CVE-2026-25368 | Medium | 6.5 | 2026-02-19 | Missing Authorization vulnerability in codepeople Calculated Fields Form calculated-fields-form allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2026-1083 | Medium | 4.4 | 2026-01-28 | The Appointment Hour Booking – Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form field configuration parameters in al… |
CVE-2026-0684 | Medium | 4.3 | 2026-01-13 | The CP Image Store with Slideshow plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.9 due to a logic error i… |
CVE-2025-68850 | High | 7.5 | 2026-01-05 | Missing Authorization vulnerability in codepeople Sell Downloads sell-downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2025-68569 | Medium | 6.5 | 2025-12-24 | Missing Authorization vulnerability in codepeople WP Time Slots Booking Form wp-time-slots-booking-form allows Exploiting Incorrectly Configured Access Control… |
CVE-2025-10019 | Medium | 6.5 | 2025-12-18 | Authorization Bypass Through User-Controlled Key vulnerability in codepeople Contact Form Email contact-form-to-email allows Exploiting Incorrectly Configured… |
CVE-2025-13318 | Medium | 5.3 | 2025-11-22 | The Booking Calendar Contact Form plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.2.60. This is due to miss… |
CVE-2025-13384 | High | 7.5 | 2025-11-22 | The CP Contact Form with PayPal plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.3.56. This is due to the pl… |
CVE-2025-13317 | Medium | 5.3 | 2025-11-22 | The Appointment Booking Calendar plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.3.96. This is due to the p… |
CVE-2025-64369 | Medium | 6.5 | 2025-11-13 | Missing Authorization vulnerability in codepeople Contact Form Email contact-form-to-email allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-64261 | Medium | 5.4 | 2025-11-13 | Missing Authorization vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows Exploiting Incorrectly Configured Access Con… |
CVE-2025-58009 | Low | 3.8 | 2025-09-22 | Missing Authorization vulnerability in codepeople CP Multi View Event Calendar cp-multi-view-calendar allows Exploiting Incorrectly Configured Access Control… |
CVE-2025-48231 | Medium | 6.5 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Booking Calendar Contact Form booking-calendar… |
CVE-2025-50025 | Medium | 5.9 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople CP Polls cp-polls allows Stored XSS.This issue… |
CVE-2025-49332 | Medium | 4.3 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in codepeople WP Time Slots Booking Form wp-time-slots-booking-form allows Cross Site Request Forgery.This issu… |
CVE-2025-49291 | Medium | 4.3 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in codepeople Calculated Fields Form calculated-fields-form allows Cross Site Request Forgery.This issue affect… |
CVE-2024-8854 | Medium | 5.4 | 2025-05-15 | The Polls CP WordPress plugin before 1.0.77 does not sanitise and escape some of its poll settings, which could allow high privilege users such as admin to per… |
CVE-2024-8851 | Medium | 5.4 | 2025-05-15 | The Polls CP WordPress plugin before 1.0.77 does not sanitise and escape some of its poll settings, which could allow high privilege users such as admin to per… |
CVE-2024-13382 | Medium | 4.8 | 2025-05-15 | The Calculated Fields Form WordPress plugin before 5.2.64 does not sanitise and escape some of its settings, which could allow high privilege users such as adm… |
CVE-2025-47472 | Medium | 5.4 | 2025-05-07 | Missing Authorization vulnerability in codepeople Music Player for WooCommerce music-player-for-woocommerce allows Exploiting Incorrectly Configured Access Con… |
CVE-2024-13381 | Medium | 4.8 | 2025-05-01 | The Calculated Fields Form WordPress plugin before 5.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as adm… |
CVE-2024-12273 | Low | 3.5 | 2025-04-29 | The Calculated Fields Form WordPress plugin before 5.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as adm… |
CVE-2025-46247 | Medium | 5.3 | 2025-04-22 | Missing Authorization vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows Accessing Functionality Not Properly Constra… |
CVE-2025-46241 | High | 8.2 | 2025-04-22 | Cross-Site Request Forgery (CSRF) vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows SQL Injection.This issue affects… |
CVE-2025-39562 | Medium | 5.9 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Payment Form for PayPal Pro payment-form-for-p… |
CVE-2024-13758 | Medium | 6.5 | 2025-01-30 | The CP Contact Form with PayPal plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.52. This is due to m… |
CVE-2025-24626 | High | 7.1 | 2025-01-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Music Store music-store allows Reflected XSS.T… |
CVE-2025-24727 | Medium | 5.9 | 2025-01-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Contact Form Email contact-form-to-email allow… |
CVE-2025-24723 | Medium | 5.9 | 2025-01-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Booking Calendar Contact Form booking-calendar… |
CVE-2025-24672 | High | 8.5 | 2025-01-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in codepeople Form Builder CP cp-easy-form-builder allows SQ… |
CVE-2024-13680 | Medium | 6.5 | 2025-01-24 | The Form Builder CP plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'CP_EASY_FORM_WILL_APPEAR_HERE' shortcode in all versions… |
CVE-2024-12274 | High | 7.5 | 2025-01-13 | The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.1.23 export settings functionality exports data to a public folder, wi… |
CVE-2023-45649 | Medium | 5.3 | 2025-01-02 | Missing Authorization vulnerability in codepeople Appointment Hour Booking appointment-hour-booking allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2024-12601 | Medium | 5.3 | 2024-12-17 | The Calculated Fields Form plugin for WordPress is vulnerable to Denial of Service in all versions up to, and including, 5.2.63. This is due to unlimited heigh… |
CVE-2023-25037 | Medium | 4.3 | 2024-12-09 | Missing Authorization vulnerability in CodePeople Booking Calendar Contact Form allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2023-23895 | Medium | 4.7 | 2024-12-09 | Missing Authorization vulnerability in CodePeople WP Time Slots Booking Form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2023-23814 | Low | 3.8 | 2024-12-09 | Missing Authorization vulnerability in CodePeople CP Multi View Event Calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2024-9940 | Medium | 5.3 | 2024-10-17 | The Calculated Fields Form plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 5.2.45. This is due to the plugin not pro… |
CVE-2024-47297 | High | 7.1 | 2024-10-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople CP Polls cp-polls allows Reflected XSS.This is… |
CVE-2024-3632 | Medium | 6.8 | 2024-07-13 | The Smart Image Gallery WordPress plugin before 1.0.19 does not have CSRF check in place when updating its settings, which could allow attackers to make a logg… |
CVE-2024-35735 | Medium | 5.3 | 2024-06-10 | Missing Authorization vulnerability in CodePeople WP Time Slots Booking Form.This issue affects WP Time Slots Booking Form: from n/a through 1.2.11. |
CVE-2024-33543 | High | 7.5 | 2024-06-09 | Missing Authorization vulnerability in CodePeople WP Time Slots Booking Form.This issue affects WP Time Slots Booking Form: from n/a through 1.2.06. |
CVE-2024-35734 | High | 7.1 | 2024-06-08 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CodePeople WP Time Slots Booking Form allows Store… |
CVE-2024-36082 | Medium | 6.5 | 2024-06-07 | SQL injection vulnerability in Music Store - WordPress eCommerce versions prior to 1.1.14 allows a remote authenticated attacker with an administrative privile… |
CVE-2023-48318 | Medium | 5.3 | 2024-06-04 | Improper Restriction of Excessive Authentication Attempts vulnerability in CodePeople Contact Form Email allows Functionality Bypass.This issue affects Contact… |
CVE-2023-28494 | Medium | 4.3 | 2024-06-04 | Missing Authorization vulnerability in CodePeople Contact Form Email allows Functionality Misuse.This issue affects Contact Form Email: from n/a through 1.3.31. |
CVE-2023-28492 | Medium | 4.3 | 2024-06-03 | Missing Authorization vulnerability in CodePeople CP Multi View Event Calendar allows Functionality Misuse.This issue affects CP Multi View Event Calendar: fro… |
CVE-2023-27460 | Medium | 4.3 | 2024-06-03 | Missing Authorization vulnerability in CodePeople, paypaldev CP Contact Form with Paypal allows Functionality Misuse.This issue affects CP Contact Form with Pa… |
CVE-2023-26523 | Medium | 4.3 | 2024-06-03 | Missing Authorization vulnerability in CodePeople Calculated Fields Form allows Functionality Misuse.This issue affects Calculated Fields Form: from n/a throug… |
CVE-2023-26521 | Medium | 4.3 | 2024-06-03 | Missing Authorization vulnerability in CodePeople Search in Place allows Functionality Misuse.This issue affects Search in Place: from n/a through 1.0.104. |
CVE-2024-32720 | Medium | 5.3 | 2024-05-17 | Improper Restriction of Excessive Authentication Attempts vulnerability in CodePeople Appointment Hour Booking allows Removing Important Client Functionality.T… |
CVE-2024-24874 | Medium | 5.3 | 2024-05-17 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in CodePeople CP Polls allows Code Injection.This issue affects CP… |
CVE-2024-24873 | Medium | 5.3 | 2024-05-17 | : Improper Control of Interaction Frequency vulnerability in CodePeople CP Polls allows Flooding.This issue affects CP Polls: from n/a through 1.0.71. |
CVE-2024-31941 | Medium | 5.4 | 2024-04-15 | Cross-Site Request Forgery (CSRF) vulnerability in CodePeople CP Media Player.This issue affects CP Media Player: from n/a through 1.1.3. |
CVE-2024-31302 | Medium | 5.3 | 2024-04-10 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in CodePeople Contact Form Email.This issue affects Contact Form Email: from n/a throu… |
CVE-2024-29759 | High | 7.1 | 2024-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodePeople Calculated Fields Form allows Reflected XSS.Th… |
CVE-2023-25039 | Medium | 4.3 | 2024-03-25 | Missing Authorization vulnerability in CodePeople Google Maps CP.This issue affects Google Maps CP: from n/a through 1.0.43. |
CVE-2024-0856 | High | 8.8 | 2024-03-20 | The Appointment Booking Calendar WordPress plugin before 1.3.83 does not have CSRF checks in some places, which could allow attackers to make logged in users p… |
CVE-2024-2020 | High | 7.2 | 2024-03-13 | The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form page href parameter in all versions up to, and includ… |
CVE-2024-0963 | Medium | 6.4 | 2024-02-02 | The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's CP_CALCULATED_FIELDS shortcode in all versions up… |
CVE-2022-41790 | Medium | 4.3 | 2024-01-17 | Missing Authorization vulnerability in CodePeople WP Time Slots Booking Form.This issue affects WP Time Slots Booking Form: from n/a through 1.1.76. |
CVE-2023-0389 | Medium | 4.8 | 2024-01-16 | The Calculated Fields Form WordPress plugin before 1.1.151 does not sanitise and escape some of its form settings, which could allow high privilege users such… |
CVE-2023-6446 | Medium | 4.4 | 2024-01-11 | The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.40 du… |
CVE-2023-51517 | Medium | 4.1 | 2023-12-29 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CodePeople Calculated Fields Form.This issue affects Calculated Fields Form: from n/a thro… |
CVE-2023-5955 | Medium | 4.8 | 2023-12-11 | The Contact Form Email WordPress plugin before 1.3.44 does not sanitise and escape some of its settings, which could allow high privilege users such as admin t… |
CVE-2023-41732 | Medium | 5.4 | 2023-10-06 | Cross-Site Request Forgery (CSRF) vulnerability in CodePeople CP Blocks plugin <= 1.0.20 versions. |
CVE-2023-36384 | High | 7.1 | 2023-07-18 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in CodePeople Booking Calendar Contact Form plugin <= 1.2.40 versions. |
CVE-2023-2718 | Medium | 5.4 | 2023-06-12 | The Contact Form Email WordPress plugin before 1.3.38 does not escape submitted values before displaying them in the HTML, leading to a Stored XSS vulnerabilit… |
CVE-2015-10099 | Medium | 6.3 | 2023-04-10 | A vulnerability classified as critical has been found in CP Appointment Calendar Plugin up to 1.1.5 on WordPress. This affects the function dex_process_ready_t… |
CVE-2023-23971 | Medium | 5.9 | 2023-04-06 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CodePeople WP Time Slots Booking Form plugin <= 1.1.81 versions. |
CVE-2014-125091 | Medium | 4.7 | 2023-03-04 | A vulnerability has been found in codepeople cp-polls Plugin 1.0.1 on WordPress and classified as critical. This vulnerability affects unknown code of the file… |
CVE-2022-3427 | High | 8.8 | 2022-12-15 | The Corner Ad plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.56. This is due to missing or incorrect no… |
CVE-2022-4036 | Medium | 5.3 | 2022-11-29 | The Appointment Hour Booking plugin for WordPress is vulnerable to CAPTCHA bypass in versions up to, and including, 1.3.72. This is due to the use of insuffici… |
CVE-2022-4035 | High | 7.2 | 2022-11-29 | The Appointment Hour Booking plugin for WordPress is vulnerable to iFrame Injection via the ‘email’ or general field parameters in versions up to, and includin… |
CVE-2022-4034 | Medium | 5.8 | 2022-11-29 | The Appointment Hour Booking Plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.3.72. This makes it possible for unauthent… |
CVE-2022-43482 | Medium | 4.3 | 2022-11-18 | Missing Authorization vulnerability in Appointment Booking Calendar plugin <= 1.3.69 on WordPress. |
CVE-2022-41692 | Medium | 4.3 | 2022-11-18 | Missing Authorization vulnerability in Appointment Hour Booking plugin <= 1.3.71 on WordPress. |
CVE-2022-2567 | Medium | 4.8 | 2022-09-19 | The Form Builder CP WordPress plugin before 1.2.32 does not sanitise and escape some of its form settings, which could allow high privilege users such as admin… |
CVE-2022-0389 | Medium | 4.8 | 2022-03-07 | The WP Time Slots Booking Form WordPress plugin before 1.1.63 does not sanitise and escape Calendar names, allowing high privilege users to perform Cross-Site… |
CVE-2021-42361 | Medium | 4.8 | 2021-11-17 | The Contact Form Email WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and escaping via the name parameter f… |
CVE-2020-9372 | High | 7.8 | 2020-03-04 | The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or Name) in any booking form to be any for… |
CVE-2020-9371 | Medium | 4.8 | 2020-03-04 | Stored XSS exists in the Appointment Booking Calendar plugin before 1.3.35 for WordPress. In the cpabc_appointments.php file, the Calendar Name input could all… |
CVE-2020-7228 | Medium | 5.4 | 2020-01-22 | The Calculated Fields Form plugin through 1.0.353 for WordPress suffers from multiple Stored XSS vulnerabilities present in the input forms. These can be explo… |
CVE-2016-10992 | Medium | 6.1 | 2019-09-17 | The music-store plugin before 1.0.43 for WordPress has XSS via the wp-admin/admin.php?page=music-store-menu-reports from_year parameter. |
CVE-2015-9348 | High | 7.5 | 2019-08-27 | The sell-downloads plugin before 1.0.8 for WordPress has insufficient restrictions on brute-force guessing of purchase IDs. |
CVE-2015-9346 | Medium | 6.1 | 2019-08-27 | The cp-polls plugin before 1.0.5 for WordPress has XSS. |
CVE-2014-10395 | Medium | 6.1 | 2019-08-27 | The cp-polls plugin before 1.0.1 for WordPress has XSS in the votes list. |