Codepeople vulnerabilities, page 5
126 vulnerabilities
Known vulnerabilities in Codepeople products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 32 products.
CVE-2019-14784codepeoplecp_contact_form_with_paypal+1
EPSS score0.94%
The "CP Contact Form with PayPal" plugin before 1.2.98 for WordPress has XSS in CSS edition.CVE-2026-40791codepeoplewp_time_slots_booking_form+1EPSS score0.25%
Unauthenticated Cross Site Scripting (XSS) in WP Time Slots Booking Form <= 1.2.46 versions.CVE-2026-13335codepeoplecodepeople post map for google maps+1EPSS score0.36%
The CodePeople Post Map for Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cpm_point' Post Meta in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.CVE-2026-1083codepeopleappointment hour booking – booking calendar+1EPSS score0.29%
The Appointment Hour Booking – Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form field configuration parameters in all versions up to, and including, 1.5.60 due to insufficient input sanitization and output escaping on the 'Min length/characters' and 'Max length/characters' field configuration values. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the form builder interface. This only affects multi-site installations and installations where unfiltered_html has been disabled.CVE-2026-65514codepeopleappointment hour booking+1EPSS score0.22%
Contributor Cross Site Scripting (XSS) in Appointment Hour Booking <= 1.5.86 versions.CVE-2026-48882codepeoplewp_time_slots_booking_form+1EPSS score0.36%
Subscriber SQL Injection in WP Time Slots Booking Form <= 1.2.50 versions.CVE-2026-0684codepeoplecp image store with slideshow+1EPSS score0.29%
The CP Image Store with Slideshow plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.9 due to a logic error in the 'cpis_admin_init' function's permission check. This makes it possible for authenticated attackers, with Contributor-level access and above, to import arbitrary products via XML, if the XML file has already been uploaded to the server.CVE-2026-25368codepeoplecalculated_fields_form+1EPSS score0.29%
Missing Authorization vulnerability in codepeople Calculated Fields Form calculated-fields-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Calculated Fields Form: from n/a through <= 5.4.4.1.CVE-2026-25465codepeoplecp multi view event calendar+1EPSS score0.22%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople CP Multi View Event Calendar cp-multi-view-calendar allows Stored XSS.This issue affects CP Multi View Event Calendar : from n/a through <= 1.4.36.CVE-2026-103909codepeoplecalculated fields form – ai form builder for wordpress – contact, payment, quote, quiz & more+1EPSS score0.27%
The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'arbitrary (whichever names the admin bound via url.<name>)' parameter in all versions up to, and including, 5.5.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the targeted site to host a publicly accessible form in which an administrator has configured at least two fields with url.<name> predefined values that are used together in a concatenation equation — a plausible but not universal configuration.CVE-2026-66679codepeopleappointment hour booking+1EPSS score0.35%
Unauthenticated Broken Access Control in Appointment Hour Booking <= 1.5.91 versions.CVE-2026-57670codepeoplegoogle_maps_cp+1EPSS score0.25%
Unauthenticated Cross Site Scripting (XSS) in Google Maps CP <= 1.2.5 versions.CVE-2026-100184codepeoplecalculated fields form – ai form builder for wordpress – contact, payment, quote, quiz & more+1EPSS score0.20%
The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'x (attacker-chosen name matching the form's url.<name> predefined value)' parameter in all versions up to, and including, 5.5.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that the targeted form has a Text Area field configured with a 'url.<name>' Predefined Value and predefinedClick disabled, which is a documented and commonly used plugin feature.CVE-2026-100179codepeoplecalculated fields form – ai form builder for wordpress – contact, payment, quote, quiz & more+1EPSS score0.21%
The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'x (any URL parameter consumed by the form's calculated equation)' parameter in all versions up to, and including, 5.5.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the target site to have a public form configured with a Select2-enabled dropdown whose choices are populated via a calculated equation that pipes a URL parameter through GETURLPARAMETER() into setChoices({texts:[...]}); given that configuration, exploitation requires only a single crafted link.CVE-2026-93624codepeoplemusic player for woocommerce+1EPSS score0.37%
Shop manager PHP Object Injection in Music Player for WooCommerce <= 1.9.1 versions.CVE-2026-95598codepeoplesearch in place+1EPSS score0.18%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Search in Place search-in-place allows Reflected XSS.This issue affects Search in Place: from n/a through 1.5.5.CVE-2026-95529codepeoplecalculated_fields_form+1EPSS score0.18%
Unauthenticated Cross Site Scripting (XSS) in Calculated Fields Form <= 5.5.1.1 versions.CVE-2026-96573codepeopleappointment hour booking – booking calendar+1EPSS score0.26%
The Appointment Hour Booking – Booking Calendar plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer in all versions up to, and including, 1.5.97 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the 'list_readmore_numberofwords' Other Parameters setting to be configured with a positive integer value; the default value of 0 bypasses the decode-and-truncate branch entirely and is not exploitable through this sink.CVE-2026-32433codepeoplecp_contact_form_with_paypal+1EPSS score0.37%
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in codepeople CP Contact Form with Paypal cp-contact-form-with-paypal allows Blind SQL Injection.This issue affects CP Contact Form with Paypal: from n/a through <= 1.3.61.CVE-2026-32483codepeoplecontact_form_email+1EPSS score0.33%
Missing Authorization vulnerability in codepeople Contact Form Email contact-form-to-email allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form Email: from n/a through <= 1.3.63.