Codepeople vulnerabilities
93 CVEs and advisories name Codepeople as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-119176CP Multi View Events Calendar <= 1.4.43 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'Subject' Parameter
- CVE-2026-111727Appointment Booking Calendar <= 1.4.05 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'vs_text_submitbtn' Parameter
- CVE-2026-115497Music Store <= 1.4.7 - Unauthenticated Arbitrary File Read via 'f' Parameter
- CVE-2026-112379WordPress Contact Form Email plugin <= 1.3.68 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-110701CP Multi View Events Calendar <= 1.4.42 - Unauthenticated Stored Cross-Site Scripting via 'CalendarTitle' Parameter
- CVE-2026-109901WordPress CP Multi View Event Calendar plugin <= 1.4.41 - SQL Injection vulnerability
- CVE-2026-95598WordPress Search in Place plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-103909Calculated Fields Form <= 5.5.1.5 - Reflected DOM-Based Cross-Site Scripting via URL Parameter Substitution in Calculated Field Equation
- CVE-2026-100184Calculated Fields Form <= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting via 'x' URL Query Parameter via Text Area Predefined Value
- CVE-2026-96573Appointment Hour Booking <= 1.5.97 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer
- CVE-2026-100179Calculated Fields Form <= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting via 'x' URL Parameter via setChoices()
- CVE-2026-93624WordPress Music Player for WooCommerce plugin <= 1.9.1 - PHP Object Injection vulnerability
- CVE-2026-95529WordPress Calculated Fields Form plugin <= 5.5.1.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-78283WordPress Music Player for WooCommerce plugin <= 1.8.9 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-78281WordPress CP Media Player plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-66679WordPress Appointment Hour Booking plugin <= 1.5.91 - Broken Access Control vulnerability
- CVE-2026-65514WordPress Appointment Hour Booking plugin <= 1.5.86 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57670WordPress Google Maps CP plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-12113Appointment Booking Calendar <= 1.4.02 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure
- CVE-2026-13335CodePeople Post Map for Google Maps <= 1.2.6 - Authenticated (Contributor +) Stored Cross-Site Scripting via 'cpm_point' Post Meta
- CVE-2026-12111Appointment Booking Calendar <= 1.4.01 - Authenticated (Contributor+) Sensitive Information Exposure via 'id' Parameter
- CVE-2026-48882WordPress WP Time Slots Booking Form plugin <= 1.2.50 - SQL Injection vulnerability
- CVE-2026-40791WordPress WP Time Slots Booking Form plugin <= 1.2.46 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-6810Booking Calendar Contact Form <= 1.2.63 - Authenticated (Subscriber+) Insecure Direct Object Reference to Calendar Takeover
- CVE-2026-32483WordPress Contact Form Email plugin <= 1.3.63 - Broken Access Control vulnerability
- CVE-2026-25465WordPress CP Multi View Event Calendar plugin <= 1.4.36 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-32433WordPress CP Contact Form with Paypal plugin <= 1.3.61 - SQL Injection vulnerability
- CVE-2026-32432WordPress WP Time Slots Booking Form plugin <= 1.2.42 - Broken Access Control vulnerability
- CVE-2026-3986Calculated Fields Form <= 5.4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Settings
- CVE-2026-25368WordPress Calculated Fields Form plugin <= 5.4.4.1 - Broken Access Control vulnerability