CveMateVulnerability intelligence

Codepeople vulnerabilities

126 vulnerabilities

Known vulnerabilities in Codepeople products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 32 products.

Products

32

Calculated Fields Form17 vulnerabilities
Appointment Booking Calendar15 vulnerabilities
Contact Form Email13 vulnerabilities
Wp Time Slots Booking Form12 vulnerabilities
Booking Calendar Contact Form8 vulnerabilities
Cp Contact Form With Paypal7 vulnerabilities
Appointment Hour Booking – Booking Calendar5 vulnerabilities
CP Multi View Event Calendar5 vulnerabilities
Polls Cp5 vulnerabilities
Appointment Hour Booking4 vulnerabilities
CP Polls4 vulnerabilities
Calculated Fields Form – AI Form Builder For Wordpress – Contact, Payment, Quote, Quiz & More3 vulnerabilities
Form Builder Cp3 vulnerabilities
Music Player For Woocommerce3 vulnerabilities
Music Store3 vulnerabilities
CP Media Player2 vulnerabilities
Google Maps Cp2 vulnerabilities
Payment Form For Paypal Pro2 vulnerabilities
Search In Place2 vulnerabilities
Sell Downloads2 vulnerabilities
Appointment Booking Calendar (Wordpress Plugin)1 vulnerabilities
Appointment Hour Booking (Wordpress Plugin)1 vulnerabilities
Codepeople Post Map For Google Maps1 vulnerabilities
Com Multicalendar1 vulnerabilities
Corner Ad1 vulnerabilities
Cp Appointment Calendar1 vulnerabilities
CP Blocks1 vulnerabilities
CP Image Store With Slideshow1 vulnerabilities
CP Multi View Events Calendar1 vulnerabilities
Cp Polls Plugin1 vulnerabilities
Music Store Wordpress Ecommerce1 vulnerabilities
Smart Image Gallery1 vulnerabilities

CVE-2026-110701codepeoplecp multi view events calendar5d ago16-10-2026 06:41

The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'CalendarTitle' parameter in all versions up to, and including, 1.4.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires that an administrator has enabled the "Allow edition in frontend?" option on at least one calendar view, which exposes the unauthenticated add endpoint and a publicly accessible nonce.CVE-2026-109901codepeoplecp multi view event calendar7d ago14-10-2026 07:11

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Codepeople CP Multi View Event Calendar cp-multi-view-calendar allows SQL Injection.This issue affects CP Multi View Event Calendar : from n/a through 1.4.41.CVE-2018-20963codepeoplecontact_form_email+17y ago13-08-2019 16:46

The contact-form-to-email plugin before 1.2.66 for WordPress has XSS.CVE-2018-20964codepeoplecontact_form_email+17y ago13-08-2019 16:46

The contact-form-to-email plugin before 1.2.66 for WordPress has CSRF.CVE-2013-5953codepeoplecom_multicalendar12y ago19-03-2014 14:00

Multiple cross-site scripting (XSS) vulnerabilities in tmpl/layout_editevent.php in the Multi Calendar (com_multicalendar) component 4.0.2, and possibly 4.8.5 and earlier, for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) calid or (2) paletteDefault parameter in an editevent action to index.php.CVE-2021-42361codepeoplecontact_form_email+24y ago17-11-2021 18:27

The Contact Form Email WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and escaping via the name parameter found in the ~/trunk/cp-admin-int-list.inc.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.3.24. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.CVE-2015-9348codepeoplesell_downloads+17y ago27-08-2019 12:21

The sell-downloads plugin before 1.0.8 for WordPress has insufficient restrictions on brute-force guessing of purchase IDs.CVE-2015-9346codepeoplepolls_cp+17y ago27-08-2019 11:49

The cp-polls plugin before 1.0.5 for WordPress has XSS.CVE-2015-9233codepeoplecp_contact_form_with_paypal+19y ago29-09-2017 21:00

The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has CSRF with resultant XSS, related to cp_contactformpp.php and cp_contactformpp_admin_int_list.inc.php.CVE-2015-7320codepeopleappointment_booking_calendar+111y ago29-09-2015 19:00

Multiple cross-site scripting (XSS) vulnerabilities in cpabc_appointments_admin_int_bookings_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.CVE-2015-7319codepeopleappointment_booking_calendar+111y ago29-09-2015 19:00

SQL injection vulnerability in cpabc_appointments_admin_int_calendar_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to updating the username.CVE-2015-7666codepeoplepayment_form_for_paypal_pro+18y ago27-12-2017 19:00

Multiple cross-site scripting (XSS) vulnerabilities in the (1) cp_updateMessageItem and (2) cp_deleteMessageItem functions in cp_ppp_admin_int_message_list.inc.php in the Payment Form for PayPal Pro plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the cal parameter.CVE-2015-10099codepeoplecp_appointment_calendar+13y ago10-04-2023 12:00

A vulnerability classified as critical has been found in CP Appointment Calendar Plugin up to 1.1.5 on WordPress. This affects the function dex_process_ready_to_go_appointment of the file dex_appointments.php. The manipulation of the argument itemnumber leads to sql injection. It is possible to initiate the attack remotely. The patch is named e29a9cdbcb0f37d887dd302a05b9e8bf213da01d. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-225351.CVE-2016-10908codepeoplebooking_calendar_contact_form+17y ago21-08-2019 12:40

The booking-calendar-contact-form plugin before 1.0.24 for WordPress has XSS.CVE-2016-10916codepeopleappointment_booking_calendar+17y ago22-08-2019 12:11

The appointment-booking-calendar plugin before 1.1.24 for WordPress has SQL injection, a different vulnerability than CVE-2015-7319.CVE-2016-10992codepeoplemusic_store+17y ago17-09-2019 14:36

The music-store plugin before 1.0.43 for WordPress has XSS via the wp-admin/admin.php?page=music-store-menu-reports from_year parameter.CVE-2016-10909codepeoplebooking_calendar_contact_form+17y ago21-08-2019 12:44

The booking-calendar-contact-form plugin before 1.0.24 for WordPress has SQL injection.CVE-2025-13317codepeopleappointment_booking_calendar+111mo ago22-11-2025 07:29

The Appointment Booking Calendar plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.3.96. This is due to the plugin exposing an unauthenticated booking processing endpoint (cpabc_appointments_check_IPN_verification) that trusts attacker-supplied payment notifications without verifying their origin, authenticity, or requiring proper authorization checks. This makes it possible for unauthenticated attackers to arbitrarily confirm bookings and insert them into the live calendar via the 'cpabc_ipncheck' parameter, triggering administrative and customer notification emails and disrupting operations.CVE-2025-13384codepeoplecp_contact_form_with_paypal+111mo ago22-11-2025 07:29

The CP Contact Form with PayPal plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.3.56. This is due to the plugin exposing an unauthenticated IPN-like endpoint (via the 'cp_contactformpp_ipncheck' query parameter) that processes payment confirmations without any authentication, nonce verification, or PayPal IPN signature validation. This makes it possible for unauthenticated attackers to mark form submissions as paid without making actual payments by sending forged payment notification requests with arbitrary POST data (payment_status, txn_id, payer_email).CVE-2025-13318codepeoplebooking_calendar_contact_form+111mo ago22-11-2025 08:30

The Booking Calendar Contact Form plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.2.60. This is due to missing authorization checks and payment verification in the `dex_bccf_check_IPN_verification` function. This makes it possible for unauthenticated attackers to arbitrarily confirm bookings and bypass payment requirements via the 'dex_bccf_ipn' parameter.