CVEs we hold for Codepeople

Records whose assigning authority named Codepeople as the affected vendor. Newest identifiers first, capped at 200.

CVE-2026-78283WordPress Music Player for WooCommerce plugin <= 1.8.9 - Cross Site Scripting (XSS) vulnerabilitycodepeople Music Player for WooCommerce

CVE-2026-78281WordPress CP Media Player plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerabilitycodepeople CP Media Player

CVE-2026-6810Booking Calendar Contact Form <= 1.2.63 - Authenticated (Subscriber+) Insecure Direct Object Reference to Calendar…codepeople Booking Calendar Contact Form

CVE-2026-66679WordPress Appointment Hour Booking plugin <= 1.5.91 - Broken Access Control vulnerabilitycodepeople Appointment Hour Booking

CVE-2026-65514WordPress Appointment Hour Booking plugin <= 1.5.86 - Cross Site Scripting (XSS) vulnerabilitycodepeople Appointment Hour Booking

CVE-2026-57670WordPress Google Maps CP plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerabilityCodepeople Google Maps CP

CVE-2026-48882WordPress WP Time Slots Booking Form plugin <= 1.2.50 - SQL Injection vulnerabilitycodepeople WP Time Slots Booking Form

CVE-2026-40791WordPress WP Time Slots Booking Form plugin <= 1.2.46 - Cross Site Scripting (XSS) vulnerabilitycodepeople WP Time Slots Booking Form

CVE-2026-3986Calculated Fields Form <= 5.4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Settingscodepeople Calculated Fields Form

CVE-2026-32483WordPress Contact Form Email plugin <= 1.3.63 - Broken Access Control vulnerabilitycodepeople Contact Form Email

CVE-2026-32433WordPress CP Contact Form with Paypal plugin <= 1.3.61 - SQL Injection vulnerabilitycodepeople CP Contact Form with Paypal

CVE-2026-32432WordPress WP Time Slots Booking Form plugin <= 1.2.42 - Broken Access Control vulnerabilitycodepeople WP Time Slots Booking Form

CVE-2026-25465WordPress CP Multi View Event Calendar plugin <= 1.4.36 - Cross Site Scripting (XSS) vulnerabilitycodepeople CP Multi View Event Calendar

CVE-2026-25368WordPress Calculated Fields Form plugin <= 5.4.4.1 - Broken Access Control vulnerabilitycodepeople Calculated Fields Form

CVE-2026-13335CodePeople Post Map for Google Maps <= 1.2.6 - Authenticated (Contributor +) Stored Cross-Site Scripting via…CodePeople Post Map for Google Maps

CVE-2026-12113Appointment Booking Calendar <= 1.4.02 - Missing Authorization to Authenticated (Contributor+) Sensitive Information…codepeople Appointment Booking Calendar

CVE-2026-12111Appointment Booking Calendar <= 1.4.01 - Authenticated (Contributor+) Sensitive Information Exposure via 'id' Parametercodepeople Appointment Booking Calendar

CVE-2026-1083Appointment Hour Booking – Booking Calendar <= 1.5.60 - Authenticated (Administrator+) Stored Cross-Site Scripting via…codepeople Appointment Hour Booking – Booking Calendar

CVE-2026-0684CP Image Store with Slideshow <= 1.1.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Product Importcodepeople CP Image Store with Slideshow

CVE-2025-68850WordPress Sell Downloads plugin <= 1.1.12 - Broken Access Control vulnerabilitycodepeople Sell Downloads

CVE-2025-68569WordPress WP Time Slots Booking Form plugin <= 1.2.39 - Broken Access Control vulnerabilitycodepeople WP Time Slots Booking Form

CVE-2025-64369WordPress Contact Form Email plugin <= 1.3.58 - Broken Access Control vulnerabilitycodepeople Contact Form Email

CVE-2025-64261WordPress Appointment Booking Calendar plugin <= 1.3.95 - Broken Access Control vulnerabilitycodepeople Appointment Booking Calendar

CVE-2025-58009WordPress CP Multi View Event Calendar plugin <= 1.4.35 - Broken Access Control vulnerabilitycodepeople CP Multi View Event Calendar

CVE-2025-50025WordPress CP Polls plugin <= 1.0.81 - Cross Site Scripting (XSS) vulnerabilitycodepeople CP Polls

CVE-2025-49332WordPress WP Time Slots Booking Form plugin <= 1.2.30 - Cross Site Request Forgery (CSRF) Vulnerabilitycodepeople WP Time Slots Booking Form

CVE-2025-49291WordPress Calculated Fields Form plugin <= 5.3.58 - Cross Site Request Forgery (CSRF) Vulnerabilitycodepeople Calculated Fields Form

CVE-2025-48231WordPress Booking Calendar Contact Form plugin <= 1.2.58 - Cross Site Scripting (XSS) Vulnerabilitycodepeople Booking Calendar Contact Form

CVE-2025-47472WordPress Music Player for WooCommerce plugin <= 1.5.1 - Broken Access Control Vulnerabilitycodepeople Music Player for WooCommerce

CVE-2025-46247WordPress Appointment Booking Calendar plugin <= 1.3.92 - Broken Access Control Vulnerabilitycodepeople Appointment Booking Calendar

CVE-2025-46241WordPress Appointment Booking Calendar plugin <= 1.3.92 - CSRF to SQL Injection vulnerabilitycodepeople Appointment Booking Calendar

CVE-2025-39562WordPress Payment Form for PayPal Pro plugin <= 1.1.72 - Cross Site Scripting (XSS) Vulnerabilitycodepeople Payment Form for PayPal Pro

CVE-2025-24727WordPress Contact Form to Email Plugin <= 1.3.52 - Cross Site Scripting (XSS) vulnerabilitycodepeople Contact Form Email

CVE-2025-24723WordPress Booking Calendar Contact Form Plugin <= 1.2.55 - Stored Cross Site Scripting (XSS) vulnerabilitycodepeople Booking Calendar Contact Form

CVE-2025-24672WordPress Form Builder CP Plugin <= 1.2.41 - SQL Injection vulnerabilitycodepeople Form Builder CP

CVE-2025-24626WordPress Music Store – WordPress eCommerce Plugin <= 1.1.19 - Reflected Cross Site Scripting (XSS) vulnerabilitycodepeople Music Store

CVE-2025-13384CP Contact Form with PayPal <= 1.3.56 - Missing Authorization to Unauthenticated Arbitrary Payment Confirmationcodepeople CP Contact Form with PayPal

CVE-2025-13318Booking Calendar Contact Form <= 1.2.60 - Missing Authorization to Unauthenticated Arbitrary Booking Confirmation via…codepeople Booking Calendar Contact Form

CVE-2025-13317Appointment Booking Calendar <= 1.3.96 - Missing Authorization to Arbitrary Booking Confirmation via 'cpabc_ipncheck'…codepeople Appointment Booking Calendar

CVE-2025-10019WordPress Contact Form Email plugin <= 1.3.60 - Insecure Direct Object References (IDOR) vulnerabilitycodepeople Contact Form Email

CVE-2024-9940Calculated Fields Form <= 5.2.45 - HTML Injectioncodepeople Calculated Fields Form

CVE-2024-47297WordPress Polls CP plugin <= 1.0.74 - Reflected Cross Site Scripting (XSS) vulnerabilitycodepeople CP Polls

CVE-2024-36082no title heldCodePeople Music Store - WordPress eCommerce

CVE-2024-35735WordPress WP Time Slots Booking Form plugin <= 1.2.11 - Broken Access Control vulnerabilityCodePeople WP Time Slots Booking Form

CVE-2024-35734WordPress WP Time Slots Booking Form plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerabilityCodePeople WP Time Slots Booking Form

CVE-2024-33543WordPress WP Time Slots Booking Form plugin <= 1.2.06 - Broken Access Control vulnerabilityCodePeople WP Time Slots Booking Form

CVE-2024-32720WordPress Appointment Hour Booking plugin <= 1.4.56 - Captcha Bypass vulnerabilityCodePeople Appointment Hour Booking

CVE-2024-31941WordPress CP Media Player plugin <= 1.1.3 - Cross Site Request Forgery (CSRF) vulnerabilityCodePeople CP Media Player

CVE-2024-31302WordPress Contact Form Email plugin <= 1.3.44 - Sensitive Data Exposure vulnerabilityCodePeople Contact Form Email

CVE-2024-29759WordPress Calculated Fields Form plugin <= 1.2.54 - Reflected Cross Site Scripting (XSS) vulnerabilityCodePeople Calculated Fields Form

CVE-2024-24874WordPress Polls CP plugin <= 1.0.71 - Content Injection vulnerabilityCodePeople CP Polls

CVE-2024-24873WordPress Polls CP plugin <= 1.0.71 - Polls Limitation Bypass vulnerabilityCodePeople CP Polls

CVE-2024-2020Calculated Fields Form Professional <= 5.1.56 - Unauthenticated Stored Cross-Site Scriptingcodepeople Calculated Fields Form

CVE-2024-13758CP Contact Form with PayPal <= 1.3.52 - Cross-Site Request Forgerycodepeople CP Contact Form with PayPal

CVE-2024-13680Form Builder CP <= 1.2.41 - Authenticated (Contributor+) SQL Injectioncodepeople Form Builder CP

CVE-2024-12601Calculated Fields Form <= 5.2.63 - Denial of Servicecodepeople Calculated Fields Form

CVE-2024-0963Calculated Fields Form <= 1.2.52 - Authenticated (Contributor+) Stored Cross-Site Scriptingcodepeople Calculated Fields Form

CVE-2023-6446Calculated Fields Form <= 1.2.40 - Authenticated (Admin+) Stored Cross-Site Scriptingcodepeople Calculated Fields Form

CVE-2023-51517WordPress Calculated Fields Form Plugin <= 1.2.28 is vulnerable to Open RedirectionCodePeople Calculated Fields Form

CVE-2023-48318WordPress Contact Form Email plugin <= 1.3.41 - Captcha Bypass vulnerabilityCodePeople Contact Form Email

CVE-2023-45649WordPress Appointment Hour Booking plugin <= 1.4.23 - Broken Access Control vulnerabilitycodepeople Appointment Hour Booking

CVE-2023-41732WordPress CP Blocks Plugin <= 1.0.20 is vulnerable to Cross Site Request Forgery (CSRF)CodePeople CP Blocks

CVE-2023-36384WordPress Booking Calendar Contact Form Plugin <= 1.2.40 is vulnerable to Cross Site Scripting (XSS)CodePeople Booking Calendar Contact Form

CVE-2023-28494WordPress Contact Form Email plugin <= 1.3.31 - Missing Authorization Leading To Feedback Submission VulnerabilityCodePeople Contact Form Email

CVE-2023-28492WordPress Calendar Event Multi View plugin <= 1.4.10 - Missing Authorization Leading To Feedback Submission…CodePeople CP Multi View Event Calendar

CVE-2023-27460WordPress CP Contact Form with PayPal plugin <= 1.3.34 - Missing Authorization Leading To Feedback Submission…CodePeople, paypaldev CP Contact Form with Paypal

CVE-2023-26523WordPress Calculated Fields Form plugin <= 1.1.120 - Missing Authorization Leading To Feedback Submission VulnerabilityCodePeople Calculated Fields Form

CVE-2023-26521WordPress Search in Place plugin <= 1.0.104 - Missing Authorization Leading To Feedback Submission vulnerabilityCodePeople Search in Place

CVE-2023-25039WordPress Google Maps CP plugin <= 1.0.43 - Missing Authorization Leading To Feedback Submission VulnerabilityCodePeople Google Maps CP

CVE-2023-25037WordPress Booking Calendar Contact Form plugin <= 1.2.34 - Broken Access Control vulnerabilityCodePeople Booking Calendar Contact Form

CVE-2023-23971WordPress WP Time Slots Booking Form Plugin <= 1.1.81 is vulnerable to Cross Site Scripting (XSS)CodePeople WP Time Slots Booking Form

CVE-2023-23895WordPress WP Time Slots Booking Form plugin <= 1.1.82 - Broken Access Control vulnerabilityCodePeople WP Time Slots Booking Form

CVE-2023-23814WordPress Calendar Event Multi View plugin <= 1.4.13 - Broken Access Control vulnerabilityCodePeople CP Multi View Event Calendar

CVE-2022-43482WordPress Appointment Booking Calendar plugin <= 1.3.69 - Missing Authorization vulnerabilityCodePeople Appointment Booking Calendar (WordPress plugin)

CVE-2022-41790WordPress WP Time Slots Booking Form Plugin <= 1.1.76 is vulnerable to Broken Access ControlCodePeople WP Time Slots Booking Form

CVE-2022-41692WordPress Appointment Hour Booking plugin <= 1.3.71 - Missing Authorization vulnerabilityCodePeople Appointment Hour Booking (WordPress plugin)

CVE-2022-4036Appointment Hour Booking <= 1.3.72 - CAPTCHA Bypasscodepeople Appointment Hour Booking – Booking Calendar

CVE-2022-4035Appointment Hour Booking <= 1.3.72 - Unauthenticated iFrame Injection via Appointment Formcodepeople Appointment Hour Booking – Booking Calendar

CVE-2022-4034Appointment Hour Booking <= 1.3.72 - CSV Injectioncodepeople Appointment Hour Booking – Booking Calendar

CVE-2022-3427Corner Ad <= 1.0.56 - Cross-Site Request Forgerycodepeople Corner Ad

CVE-2014-125091codepeople cp-polls Plugin cp-admin-int-message-list.inc.php sql injectioncodepeople cp-polls Plugin

81 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.