CveMateVulnerability intelligence

Codepeople vulnerabilities, page 2

126 vulnerabilities

Known vulnerabilities in Codepeople products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 32 products.

CVE-2025-68569codepeoplewp_time_slots_booking_form+110mo ago24-12-2025 13:10

Missing Authorization vulnerability in codepeople WP Time Slots Booking Form wp-time-slots-booking-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Time Slots Booking Form: from n/a through <= 1.2.39.CVE-2025-68850codepeoplesell_downloads+19mo ago05-01-2026 10:43

Missing Authorization vulnerability in codepeople Sell Downloads sell-downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sell Downloads: from n/a through <= 1.1.12.CVE-2025-47472codepeoplemusic player for woocommerce+11y ago07-05-2025 14:19

Missing Authorization vulnerability in codepeople Music Player for WooCommerce music-player-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Music Player for WooCommerce: from n/a through <= 1.5.1.CVE-2025-48231codepeoplebooking_calendar_contact_form+11y ago04-07-2025 11:18

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Booking Calendar Contact Form booking-calendar-contact-form allows Stored XSS.This issue affects Booking Calendar Contact Form: from n/a through <= 1.2.58.CVE-2025-39562codepeoplepayment_form_for_paypal_pro+11y ago17-04-2025 15:46

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Payment Form for PayPal Pro payment-form-for-paypal-pro allows Stored XSS.This issue affects Payment Form for PayPal Pro: from n/a through <= 1.1.72.CVE-2025-58009codepeoplecp multi view event calendar+11y ago22-09-2025 18:24

Missing Authorization vulnerability in codepeople CP Multi View Event Calendar cp-multi-view-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CP Multi View Event Calendar : from n/a through <= 1.4.35.CVE-2025-46241codepeopleappointment_booking_calendar+11y ago22-04-2025 09:53

Cross-Site Request Forgery (CSRF) vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows SQL Injection.This issue affects Appointment Booking Calendar: from n/a through <= 1.3.92.CVE-2025-46247codepeopleappointment_booking_calendar+11y ago22-04-2025 09:53

Missing Authorization vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Appointment Booking Calendar: from n/a through <= 1.3.92.CVE-2025-10019codepeoplecontact_form_email+110mo ago18-12-2025 07:21

Authorization Bypass Through User-Controlled Key vulnerability in codepeople Contact Form Email contact-form-to-email allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form Email: from n/a through <= 1.3.60.CVE-2025-24626codepeoplemusic_store+11y ago27-01-2025 14:22

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Music Store music-store allows Reflected XSS.This issue affects Music Store: from n/a through <= 1.1.19.CVE-2025-24723codepeoplebooking_calendar_contact_form+11y ago24-01-2025 17:25

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Booking Calendar Contact Form booking-calendar-contact-form allows Stored XSS.This issue affects Booking Calendar Contact Form: from n/a through <= 1.2.55.CVE-2025-24727codepeoplecontact_form_email+11y ago24-01-2025 17:25

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Contact Form Email contact-form-to-email allows Stored XSS.This issue affects Contact Form Email: from n/a through <= 1.3.52.CVE-2025-24672codepeopleform_builder_cp+11y ago24-01-2025 17:24

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in codepeople Form Builder CP cp-easy-form-builder allows SQL Injection.This issue affects Form Builder CP: from n/a through <= 1.2.41.CVE-2025-64261codepeopleappointment_booking_calendar+111mo ago13-11-2025 09:24

Missing Authorization vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Appointment Booking Calendar: from n/a through <= 1.3.95.CVE-2025-64369codepeoplecontact_form_email+111mo ago13-11-2025 09:24

Missing Authorization vulnerability in codepeople Contact Form Email contact-form-to-email allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form Email: from n/a through <= 1.3.58.CVE-2025-49291codepeoplecalculated_fields_form+11y ago06-06-2025 12:53

Cross-Site Request Forgery (CSRF) vulnerability in codepeople Calculated Fields Form calculated-fields-form allows Cross Site Request Forgery.This issue affects Calculated Fields Form: from n/a through <= 5.3.58.CVE-2025-49332codepeoplewp_time_slots_booking_form+11y ago06-06-2025 12:53

Cross-Site Request Forgery (CSRF) vulnerability in codepeople WP Time Slots Booking Form wp-time-slots-booking-form allows Cross Site Request Forgery.This issue affects WP Time Slots Booking Form: from n/a through <= 1.2.30.CVE-2025-50025codepeoplecp polls+11y ago20-06-2025 15:03

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople CP Polls cp-polls allows Stored XSS.This issue affects CP Polls: from n/a through <= 1.0.81.CVE-2020-9371codepeopleappointment_booking_calendar+16y ago04-03-2020 18:11

Stored XSS exists in the Appointment Booking Calendar plugin before 1.3.35 for WordPress. In the cpabc_appointments.php file, the Calendar Name input could allow attackers to inject arbitrary JavaScript or HTML.CVE-2020-9372codepeopleappointment_booking_calendar+16y ago04-03-2020 18:12

The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or Name) in any booking form to be any formula, which then could be exported via the Bookings list tab in /wp-admin/admin.php?page=cpabc_appointments.php. The attacker could achieve remote code execution via CSV injection.