CveMateVulnerability intelligence

Codepeople vulnerabilities, page 3

126 vulnerabilities

Known vulnerabilities in Codepeople products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 32 products.

CVE-2020-7228codepeoplecalculated_fields_form+16y ago22-01-2020 14:10

The Calculated Fields Form plugin through 1.0.353 for WordPress suffers from multiple Stored XSS vulnerabilities present in the input forms. These can be exploited by an authenticated user.CVE-2014-125091codepeoplecp-polls plugin+23y ago04-03-2023 22:00

A vulnerability has been found in codepeople cp-polls Plugin 1.0.1 on WordPress and classified as critical. This vulnerability affects unknown code of the file cp-admin-int-message-list.inc.php. The manipulation of the argument lu leads to sql injection. The attack can be initiated remotely. Upgrading to version 1.0.2 is able to address this issue. The name of the patch is 6d7168cbf12d1c183bacc5cd5678f6f5b0d518d2. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-222268.CVE-2014-10395codepeoplepolls_cp+17y ago27-08-2019 11:50

The cp-polls plugin before 1.0.1 for WordPress has XSS in the votes list.CVE-2022-2567codepeopleform_builder_cp+24y ago19-09-2022 14:00

The Form Builder CP WordPress plugin before 1.2.32 does not sanitise and escape some of its form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)CVE-2022-41790codepeoplewp_time_slots_booking_form+12y ago17-01-2024 18:13

Missing Authorization vulnerability in CodePeople WP Time Slots Booking Form.This issue affects WP Time Slots Booking Form: from n/a through 1.1.76.CVE-2022-41692codepeopleappointment hour booking (wordpress plugin)+23y ago18-11-2022 18:54

Missing Authorization vulnerability in Appointment Hour Booking plugin <= 1.3.71 on WordPress.CVE-2022-0389codepeoplewp_time_slots_booking_form+24y ago07-03-2022 08:16

The WP Time Slots Booking Form WordPress plugin before 1.1.63 does not sanitise and escape Calendar names, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.CVE-2022-4034codepeopleappointment hour booking – booking calendar+23y ago29-11-2022 20:30

The Appointment Hour Booking Plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.3.72. This makes it possible for unauthenticated attackers to embed untrusted input into content during booking creation that may be exported as a CSV file when a site's administrator exports booking details. This can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.CVE-2022-4035codepeopleappointment hour booking – booking calendar+23y ago29-11-2022 20:32

The Appointment Hour Booking plugin for WordPress is vulnerable to iFrame Injection via the ‘email’ or general field parameters in versions up to, and including, 1.3.72 due to insufficient input sanitization and output escaping that makes injecting iFrame tags possible. This makes it possible for unauthenticated attackers to inject iFrames when submitting a booking that will execute whenever a user accesses the injected booking details page.CVE-2022-4036codepeopleappointment hour booking – booking calendar+23y ago29-11-2022 20:34

The Appointment Hour Booking plugin for WordPress is vulnerable to CAPTCHA bypass in versions up to, and including, 1.3.72. This is due to the use of insufficiently strong hashing algorithm on the CAPTCHA secret that is also displayed to the user via a cookie.CVE-2022-43482codepeopleappointment_booking_calendar+23y ago18-11-2022 19:03

Missing Authorization vulnerability in Appointment Booking Calendar plugin <= 1.3.69 on WordPress.CVE-2022-3427codepeoplecorner ad+23y ago15-12-2022 04:02

The Corner Ad plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.56. This is due to missing or incorrect nonce validation on its corner_ad_settings_page function. This makes it possible for unauthenticated attackers to trigger the deletion of ads via forged request granted they can trick a site administrator into performing an action such as clicking on a link.CVE-2024-2020codepeoplecalculated_fields_form+12y ago13-03-2024 15:26

The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form page href parameter in all versions up to, and including, 5.1.56 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the professional version or higher.CVE-2024-13758codepeoplecp_contact_form_with_paypal+21y ago30-01-2025 08:21

The CP Contact Form with PayPal plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.52. This is due to missing or incorrect nonce validation on the cp_contact_form_paypal_check_init_actions() function. This makes it possible for unauthenticated attackers to add discount codes via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.CVE-2024-13680codepeopleform_builder_cp+11y ago24-01-2025 07:04

The Form Builder CP plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'CP_EASY_FORM_WILL_APPEAR_HERE' shortcode in all versions up to, and including, 1.2.41 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.CVE-2024-13381codepeoplecalculated_fields_form+21y ago01-05-2025 06:00

The Calculated Fields Form WordPress plugin before 5.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).CVE-2024-13382codepeoplecalculated_fields_form+21y ago15-05-2025 20:07

The Calculated Fields Form WordPress plugin before 5.2.64 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).CVE-2024-47297codepeoplecp polls+12y ago06-10-2024 11:46

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople CP Polls cp-polls allows Reflected XSS.This issue affects CP Polls: from n/a through <= 1.0.74.CVE-2024-0963codepeoplecalculated_fields_form+12y ago02-02-2024 11:34

The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's CP_CALCULATED_FIELDS shortcode in all versions up to, and including, 1.2.52 due to insufficient input sanitization and output escaping on user supplied 'location' attribute. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2024-0856codepeopleappointment_booking_calendar+22y ago20-03-2024 05:00

The Appointment Booking Calendar WordPress plugin before 1.3.83 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as adding a booking to the calendar without paying.