Codepeople vulnerabilities
93 CVEs and advisories name Codepeople as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-1083Appointment Hour Booking – Booking Calendar <= 1.5.60 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Min/Max Length' Field Configuration
- CVE-2026-0684CP Image Store with Slideshow <= 1.1.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Product Import
- CVE-2025-68850WordPress Sell Downloads plugin <= 1.1.12 - Broken Access Control vulnerability
- CVE-2025-68569WordPress WP Time Slots Booking Form plugin <= 1.2.39 - Broken Access Control vulnerability
- CVE-2025-10019WordPress Contact Form Email plugin <= 1.3.60 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2025-13318Booking Calendar Contact Form <= 1.2.60 - Missing Authorization to Unauthenticated Arbitrary Booking Confirmation via 'dex_bccf_ipn' Parameter
- CVE-2025-13384CP Contact Form with PayPal <= 1.3.56 - Missing Authorization to Unauthenticated Arbitrary Payment Confirmation
- CVE-2025-13317Appointment Booking Calendar <= 1.3.96 - Missing Authorization to Arbitrary Booking Confirmation via 'cpabc_ipncheck' Parameter
- CVE-2025-64369WordPress Contact Form Email plugin <= 1.3.58 - Broken Access Control vulnerability
- CVE-2025-64261WordPress Appointment Booking Calendar plugin <= 1.3.95 - Broken Access Control vulnerability
- CVE-2025-58009WordPress CP Multi View Event Calendar plugin <= 1.4.35 - Broken Access Control vulnerability
- CVE-2025-48231WordPress Booking Calendar Contact Form plugin <= 1.2.58 - Cross Site Scripting (XSS) Vulnerability
- CVE-2025-50025WordPress CP Polls plugin <= 1.0.81 - Cross Site Scripting (XSS) vulnerability
- CVE-2025-49332WordPress WP Time Slots Booking Form plugin <= 1.2.30 - Cross Site Request Forgery (CSRF) Vulnerability
- CVE-2025-49291WordPress Calculated Fields Form plugin <= 5.3.58 - Cross Site Request Forgery (CSRF) Vulnerability
- CVE-2025-47472WordPress Music Player for WooCommerce plugin <= 1.5.1 - Broken Access Control Vulnerability
- CVE-2025-46247WordPress Appointment Booking Calendar plugin <= 1.3.92 - Broken Access Control Vulnerability
- CVE-2025-46241WordPress Appointment Booking Calendar plugin <= 1.3.92 - CSRF to SQL Injection vulnerability
- CVE-2025-39562WordPress Payment Form for PayPal Pro plugin <= 1.1.72 - Cross Site Scripting (XSS) Vulnerability
- CVE-2024-13758CP Contact Form with PayPal <= 1.3.52 - Cross-Site Request Forgery
- CVE-2025-24626WordPress Music Store – WordPress eCommerce Plugin <= 1.1.19 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2025-24723WordPress Booking Calendar Contact Form Plugin <= 1.2.55 - Stored Cross Site Scripting (XSS) vulnerability
- CVE-2025-24727WordPress Contact Form to Email Plugin <= 1.3.52 - Cross Site Scripting (XSS) vulnerability
- CVE-2025-24672WordPress Form Builder CP Plugin <= 1.2.41 - SQL Injection vulnerability
- CVE-2024-13680Form Builder CP <= 1.2.41 - Authenticated (Contributor+) SQL Injection
- CVE-2023-45649WordPress Appointment Hour Booking plugin <= 1.4.23 - Broken Access Control vulnerability
- CVE-2024-12601Calculated Fields Form <= 5.2.63 - Denial of Service
- CVE-2023-23814WordPress Calendar Event Multi View plugin <= 1.4.13 - Broken Access Control vulnerability
- CVE-2023-23895WordPress WP Time Slots Booking Form plugin <= 1.1.82 - Broken Access Control vulnerability
- CVE-2023-25037WordPress Booking Calendar Contact Form plugin <= 1.2.34 - Broken Access Control vulnerability