# cve.now: Codepeople

The newest entries naming Codepeople as an affected vendor (up to 200), of 93 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-119176](https://cve.now/CVE-2026-119176.md): CP Multi View Events Calendar \<= 1.4.43 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'Subject' Parameter (CVSS 6.4)
- [CVE-2026-111727](https://cve.now/CVE-2026-111727.md): Appointment Booking Calendar \<= 1.4.05 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'vs\_text\_submitbtn' Parameter (CVSS 6.4)
- [CVE-2026-115497](https://cve.now/CVE-2026-115497.md): Music Store \<= 1.4.7 - Unauthenticated Arbitrary File Read via 'f' Parameter (CVSS 7.5)
- [CVE-2026-112379](https://cve.now/CVE-2026-112379.md): WordPress Contact Form Email plugin \<= 1.3.68 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-110701](https://cve.now/CVE-2026-110701.md): CP Multi View Events Calendar \<= 1.4.42 - Unauthenticated Stored Cross-Site Scripting via 'CalendarTitle' Parameter (CVSS 7.2)
- [CVE-2026-109901](https://cve.now/CVE-2026-109901.md): WordPress CP Multi View Event Calendar plugin \<= 1.4.41 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2026-95598](https://cve.now/CVE-2026-95598.md): WordPress Search in Place plugin \<= 1.5.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-103909](https://cve.now/CVE-2026-103909.md): Calculated Fields Form \<= 5.5.1.5 - Reflected DOM-Based Cross-Site Scripting via URL Parameter Substitution in Calculated Field Equation (CVSS 6.1)
- [CVE-2026-100184](https://cve.now/CVE-2026-100184.md): Calculated Fields Form \<= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting via 'x' URL Query Parameter via Text Area Predefined Value (CVSS 4.7)
- [CVE-2026-96573](https://cve.now/CVE-2026-96573.md): Appointment Hour Booking \<= 1.5.97 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer (CVSS 7.2)
- [CVE-2026-100179](https://cve.now/CVE-2026-100179.md): Calculated Fields Form \<= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting via 'x' URL Parameter via setChoices() (CVSS 6.1)
- [CVE-2026-93624](https://cve.now/CVE-2026-93624.md): WordPress Music Player for WooCommerce plugin \<= 1.9.1 - PHP Object Injection vulnerability (CVSS 7.2)
- [CVE-2026-95529](https://cve.now/CVE-2026-95529.md): WordPress Calculated Fields Form plugin \<= 5.5.1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-78283](https://cve.now/CVE-2026-78283.md): WordPress Music Player for WooCommerce plugin \<= 1.8.9 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-78281](https://cve.now/CVE-2026-78281.md): WordPress CP Media Player plugin \<= 1.3.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-66679](https://cve.now/CVE-2026-66679.md): WordPress Appointment Hour Booking plugin \<= 1.5.91 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-65514](https://cve.now/CVE-2026-65514.md): WordPress Appointment Hour Booking plugin \<= 1.5.86 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-57670](https://cve.now/CVE-2026-57670.md): WordPress Google Maps CP plugin \<= 1.2.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-12113](https://cve.now/CVE-2026-12113.md): Appointment Booking Calendar \<= 1.4.02 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure (CVSS 4.3)
- [CVE-2026-13335](https://cve.now/CVE-2026-13335.md): CodePeople Post Map for Google Maps \<= 1.2.6 - Authenticated (Contributor +) Stored Cross-Site Scripting via 'cpm\_point' Post Meta (CVSS 6.4)
- [CVE-2026-12111](https://cve.now/CVE-2026-12111.md): Appointment Booking Calendar \<= 1.4.01 - Authenticated (Contributor+) Sensitive Information Exposure via 'id' Parameter (CVSS 4.3)
- [CVE-2026-48882](https://cve.now/CVE-2026-48882.md): WordPress WP Time Slots Booking Form plugin \<= 1.2.50 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2026-40791](https://cve.now/CVE-2026-40791.md): WordPress WP Time Slots Booking Form plugin \<= 1.2.46 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2026-6810](https://cve.now/CVE-2026-6810.md): Booking Calendar Contact Form \<= 1.2.63 - Authenticated (Subscriber+) Insecure Direct Object Reference to Calendar Takeover (CVSS 5.3)
- [CVE-2026-32483](https://cve.now/CVE-2026-32483.md): WordPress Contact Form Email plugin \<= 1.3.63 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-25465](https://cve.now/CVE-2026-25465.md): WordPress CP Multi View Event Calendar plugin \<= 1.4.36 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-32433](https://cve.now/CVE-2026-32433.md): WordPress CP Contact Form with Paypal plugin \<= 1.3.61 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2026-32432](https://cve.now/CVE-2026-32432.md): WordPress WP Time Slots Booking Form plugin \<= 1.2.42 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2026-3986](https://cve.now/CVE-2026-3986.md): Calculated Fields Form \<= 5.4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Settings (CVSS 6.4)
- [CVE-2026-25368](https://cve.now/CVE-2026-25368.md): WordPress Calculated Fields Form plugin \<= 5.4.4.1 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2026-1083](https://cve.now/CVE-2026-1083.md): Appointment Hour Booking – Booking Calendar \<= 1.5.60 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Min/Max Length' Field Configuration (CVSS 4.4)
- [CVE-2026-0684](https://cve.now/CVE-2026-0684.md): CP Image Store with Slideshow \<= 1.1.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Product Import (CVSS 4.3)
- [CVE-2025-68850](https://cve.now/CVE-2025-68850.md): WordPress Sell Downloads plugin \<= 1.1.12 - Broken Access Control vulnerability (CVSS 7.5)
- [CVE-2025-68569](https://cve.now/CVE-2025-68569.md): WordPress WP Time Slots Booking Form plugin \<= 1.2.39 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2025-10019](https://cve.now/CVE-2025-10019.md): WordPress Contact Form Email plugin \<= 1.3.60 - Insecure Direct Object References (IDOR) vulnerability (CVSS 6.5)
- [CVE-2025-13318](https://cve.now/CVE-2025-13318.md): Booking Calendar Contact Form \<= 1.2.60 - Missing Authorization to Unauthenticated Arbitrary Booking Confirmation via 'dex\_bccf\_ipn' Parameter (CVSS 5.3)
- [CVE-2025-13384](https://cve.now/CVE-2025-13384.md): CP Contact Form with PayPal \<= 1.3.56 - Missing Authorization to Unauthenticated Arbitrary Payment Confirmation (CVSS 7.5)
- [CVE-2025-13317](https://cve.now/CVE-2025-13317.md): Appointment Booking Calendar \<= 1.3.96 - Missing Authorization to Arbitrary Booking Confirmation via 'cpabc\_ipncheck' Parameter (CVSS 5.3)
- [CVE-2025-64369](https://cve.now/CVE-2025-64369.md): WordPress Contact Form Email plugin \<= 1.3.58 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2025-64261](https://cve.now/CVE-2025-64261.md): WordPress Appointment Booking Calendar plugin \<= 1.3.95 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2025-58009](https://cve.now/CVE-2025-58009.md): WordPress CP Multi View Event Calendar plugin \<= 1.4.35 - Broken Access Control vulnerability (CVSS 3.8)
- [CVE-2025-48231](https://cve.now/CVE-2025-48231.md): WordPress Booking Calendar Contact Form plugin \<= 1.2.58 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-50025](https://cve.now/CVE-2025-50025.md): WordPress CP Polls plugin \<= 1.0.81 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2025-49332](https://cve.now/CVE-2025-49332.md): WordPress WP Time Slots Booking Form plugin \<= 1.2.30 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3)
- [CVE-2025-49291](https://cve.now/CVE-2025-49291.md): WordPress Calculated Fields Form plugin \<= 5.3.58 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3)
- [CVE-2025-47472](https://cve.now/CVE-2025-47472.md): WordPress Music Player for WooCommerce plugin \<= 1.5.1 - Broken Access Control Vulnerability (CVSS 5.4)
- [CVE-2025-46247](https://cve.now/CVE-2025-46247.md): WordPress Appointment Booking Calendar plugin \<= 1.3.92 - Broken Access Control Vulnerability (CVSS 5.3)
- [CVE-2025-46241](https://cve.now/CVE-2025-46241.md): WordPress Appointment Booking Calendar plugin \<= 1.3.92 - CSRF to SQL Injection vulnerability (CVSS 8.2)
- [CVE-2025-39562](https://cve.now/CVE-2025-39562.md): WordPress Payment Form for PayPal Pro plugin \<= 1.1.72 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9)
- [CVE-2024-13758](https://cve.now/CVE-2024-13758.md): CP Contact Form with PayPal \<= 1.3.52 - Cross-Site Request Forgery (CVSS 6.5)
- [CVE-2025-24626](https://cve.now/CVE-2025-24626.md): WordPress Music Store – WordPress eCommerce Plugin \<= 1.1.19 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-24723](https://cve.now/CVE-2025-24723.md): WordPress Booking Calendar Contact Form Plugin \<= 1.2.55 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2025-24727](https://cve.now/CVE-2025-24727.md): WordPress Contact Form to Email Plugin \<= 1.3.52 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2025-24672](https://cve.now/CVE-2025-24672.md): WordPress Form Builder CP Plugin \<= 1.2.41 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2024-13680](https://cve.now/CVE-2024-13680.md): Form Builder CP \<= 1.2.41 - Authenticated (Contributor+) SQL Injection (CVSS 6.5)
- [CVE-2023-45649](https://cve.now/CVE-2023-45649.md): WordPress Appointment Hour Booking plugin \<= 1.4.23 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2024-12601](https://cve.now/CVE-2024-12601.md): Calculated Fields Form \<= 5.2.63 - Denial of Service (CVSS 5.3)
- [CVE-2023-23814](https://cve.now/CVE-2023-23814.md): WordPress Calendar Event Multi View plugin \<= 1.4.13 - Broken Access Control vulnerability (CVSS 3.8)
- [CVE-2023-23895](https://cve.now/CVE-2023-23895.md): WordPress WP Time Slots Booking Form plugin \<= 1.1.82 - Broken Access Control vulnerability (CVSS 4.7)
- [CVE-2023-25037](https://cve.now/CVE-2023-25037.md): WordPress Booking Calendar Contact Form plugin \<= 1.2.34 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2024-9940](https://cve.now/CVE-2024-9940.md): Calculated Fields Form \<= 5.2.45 - HTML Injection (CVSS 5.3)
- [CVE-2024-47297](https://cve.now/CVE-2024-47297.md): WordPress Polls CP plugin \<= 1.0.74 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2024-35735](https://cve.now/CVE-2024-35735.md): WordPress WP Time Slots Booking Form plugin \<= 1.2.11 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2024-33543](https://cve.now/CVE-2024-33543.md): WordPress WP Time Slots Booking Form plugin \<= 1.2.06 - Broken Access Control vulnerability (CVSS 7.5)
- [CVE-2024-35734](https://cve.now/CVE-2024-35734.md): WordPress WP Time Slots Booking Form plugin \<= 1.2.10 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2024-36082](https://cve.now/CVE-2024-36082.md): SQL injection vulnerability in Music Store - WordPress eCommerce versions prior to 1.1.14 allows a remote authenticated attacker with an adm (CVSS 6.5)
- [CVE-2023-48318](https://cve.now/CVE-2023-48318.md): WordPress Contact Form Email plugin \<= 1.3.41 - Captcha Bypass vulnerability (CVSS 5.3)
- [CVE-2023-28494](https://cve.now/CVE-2023-28494.md): WordPress Contact Form Email plugin \<= 1.3.31 - Missing Authorization Leading To Feedback Submission Vulnerability (CVSS 4.3)
- [CVE-2023-28492](https://cve.now/CVE-2023-28492.md): WordPress Calendar Event Multi View plugin \<= 1.4.10 - Missing Authorization Leading To Feedback Submission vulnerability (CVSS 4.3)
- [CVE-2023-26523](https://cve.now/CVE-2023-26523.md): WordPress Calculated Fields Form plugin \<= 1.1.120 - Missing Authorization Leading To Feedback Submission Vulnerability (CVSS 4.3)
- [CVE-2023-26521](https://cve.now/CVE-2023-26521.md): WordPress Search in Place plugin \<= 1.0.104 - Missing Authorization Leading To Feedback Submission vulnerability (CVSS 4.3)
- [CVE-2024-32720](https://cve.now/CVE-2024-32720.md): WordPress Appointment Hour Booking plugin \<= 1.4.56 - Captcha Bypass vulnerability (CVSS 5.3)
- [CVE-2024-24873](https://cve.now/CVE-2024-24873.md): WordPress Polls CP plugin \<= 1.0.71 - Polls Limitation Bypass vulnerability (CVSS 5.3)
- [CVE-2024-24874](https://cve.now/CVE-2024-24874.md): WordPress Polls CP plugin \<= 1.0.71 - Content Injection vulnerability (CVSS 5.3)
- [CVE-2024-31941](https://cve.now/CVE-2024-31941.md): WordPress CP Media Player plugin \<= 1.1.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4)
- [CVE-2024-31302](https://cve.now/CVE-2024-31302.md): WordPress Contact Form Email plugin \<= 1.3.44 - Sensitive Data Exposure vulnerability (CVSS 5.3)
- [CVE-2024-29759](https://cve.now/CVE-2024-29759.md): WordPress Calculated Fields Form plugin \<= 1.2.54 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2023-25039](https://cve.now/CVE-2023-25039.md): WordPress Google Maps CP plugin \<= 1.0.43 - Missing Authorization Leading To Feedback Submission Vulnerability (CVSS 4.3)
- [CVE-2024-2020](https://cve.now/CVE-2024-2020.md): Calculated Fields Form Professional \<= 5.1.56 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2)
- [CVE-2024-0963](https://cve.now/CVE-2024-0963.md): Calculated Fields Form \<= 1.2.52 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2022-41790](https://cve.now/CVE-2022-41790.md): WordPress WP Time Slots Booking Form Plugin \<= 1.1.76 is vulnerable to Broken Access Control (CVSS 4.3)
- [CVE-2023-6446](https://cve.now/CVE-2023-6446.md): Calculated Fields Form \<= 1.2.40 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4)
- [CVE-2023-51517](https://cve.now/CVE-2023-51517.md): WordPress Calculated Fields Form Plugin \<= 1.2.28 is vulnerable to Open Redirection (CVSS 4.1)
- [CVE-2023-41732](https://cve.now/CVE-2023-41732.md): WordPress CP Blocks Plugin \<= 1.0.20 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4)
- [CVE-2023-36384](https://cve.now/CVE-2023-36384.md): WordPress Booking Calendar Contact Form Plugin \<= 1.2.40 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1)
- [CVE-2023-23971](https://cve.now/CVE-2023-23971.md): WordPress WP Time Slots Booking Form Plugin \<= 1.1.81 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9)
- [CVE-2014-125091](https://cve.now/CVE-2014-125091.md): codepeople cp-polls Plugin cp-admin-int-message-list.inc.php sql injection (CVSS 4.7)
- [CVE-2022-3427](https://cve.now/CVE-2022-3427.md): Corner Ad \<= 1.0.56 - Cross-Site Request Forgery (CVSS 8.8)
- [CVE-2022-4036](https://cve.now/CVE-2022-4036.md): Appointment Hour Booking \<= 1.3.72 - CAPTCHA Bypass (CVSS 5.3)
- [CVE-2022-4035](https://cve.now/CVE-2022-4035.md): Appointment Hour Booking \<= 1.3.72 - Unauthenticated iFrame Injection via Appointment Form (CVSS 7.2)
- [CVE-2022-4034](https://cve.now/CVE-2022-4034.md): Appointment Hour Booking \<= 1.3.72 - CSV Injection (CVSS 5.8)
- [CVE-2022-43482](https://cve.now/CVE-2022-43482.md): WordPress Appointment Booking Calendar plugin \<= 1.3.69 - Missing Authorization vulnerability (CVSS 4.3)
- [CVE-2022-41692](https://cve.now/CVE-2022-41692.md): WordPress Appointment Hour Booking plugin \<= 1.3.71 - Missing Authorization vulnerability (CVSS 4.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/codepeople
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.