Codepeople Contact Form Email vulnerabilities
13 vulnerabilities
Known vulnerabilities in Codepeople Contact Form Email, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2018-20963codepeoplecontact_form_email+1
EPSS score0.92%
The contact-form-to-email plugin before 1.2.66 for WordPress has XSS.CVE-2018-20964codepeoplecontact_form_email+1EPSS score0.68%
The contact-form-to-email plugin before 1.2.66 for WordPress has CSRF.CVE-2021-42361codepeoplecontact_form_email+2EPSS score0.62%
The Contact Form Email WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and escaping via the name parameter found in the ~/trunk/cp-admin-int-list.inc.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.3.24. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.CVE-2025-10019codepeoplecontact_form_email+1EPSS score0.44%
Authorization Bypass Through User-Controlled Key vulnerability in codepeople Contact Form Email contact-form-to-email allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form Email: from n/a through <= 1.3.60.CVE-2025-24727codepeoplecontact_form_email+1EPSS score0.31%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Contact Form Email contact-form-to-email allows Stored XSS.This issue affects Contact Form Email: from n/a through <= 1.3.52.CVE-2025-64369codepeoplecontact_form_email+1EPSS score0.25%
Missing Authorization vulnerability in codepeople Contact Form Email contact-form-to-email allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form Email: from n/a through <= 1.3.58.CVE-2024-31302codepeoplecontact_form_email+1EPSS score0.47%
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in CodePeople Contact Form Email.This issue affects Contact Form Email: from n/a through 1.3.44.CVE-2019-9646codepeoplecontact_form_email+1EPSS score1.39%
The Contact Form Email plugin before 1.2.66 for WordPress allows wp-admin/admin.php item XSS, related to cp_admin_int_edition.inc.php in the "custom edition area."CVE-2026-32483codepeoplecontact_form_email+1EPSS score0.33%
Missing Authorization vulnerability in codepeople Contact Form Email contact-form-to-email allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form Email: from n/a through <= 1.3.63.CVE-2023-2718codepeoplecontact_form_email+2EPSS score0.51%
The Contact Form Email WordPress plugin before 1.3.38 does not escape submitted values before displaying them in the HTML, leading to a Stored XSS vulnerability.CVE-2023-48318codepeoplecontact_form_email+1EPSS score0.31%
Improper Restriction of Excessive Authentication Attempts vulnerability in CodePeople Contact Form Email allows Functionality Bypass.This issue affects Contact Form Email: from n/a through 1.3.41.CVE-2023-5955codepeoplecontact_form_email+2EPSS score0.46%
The Contact Form Email WordPress plugin before 1.3.44 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)CVE-2023-28494codepeoplecontact_form_email+1EPSS score0.31%
Missing Authorization vulnerability in CodePeople Contact Form Email allows Functionality Misuse.This issue affects Contact Form Email: from n/a through 1.3.31.