← Back

Codepeople

codepeople

62 CVEs • 15 products

Products (15)

Click to collapse
Toggle
Calculated Fields Form
calculated_fields_form
13 CVEs
Appointment Booking Calendar
appointment_booking_calendar
11 CVEs
Contact Form Email
contact_form_email
10 CVEs
Wp Time Slots Booking Form
wp_time_slots_booking_form
7 CVEs
Polls Cp
polls_cp
5 CVEs
Cp Contact Form With Paypal
cp_contact_form_with_paypal
4 CVEs
Booking Calendar Contact Form
booking_calendar_contact_form
2 CVEs
Music Store
music_store
2 CVEs
Form Builder Cp
form_builder_cp
2 CVEs
Com Multicalendar
com_multicalendar
1 CVE
Payment Form For Paypal Pro
payment_form_for_paypal_pro
1 CVE
Sell Downloads
sell_downloads
1 CVE
Cp Appointment Calendar
cp_appointment_calendar
1 CVE
Google Maps Cp
google_maps_cp
1 CVE
Smart Image Gallery
smart_image_gallery
1 CVE

CVEs (62)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2021-42361
1Codepeople
1Contact Form Email
Jun 17, 2026
Nov 17, 2021
N/A· v4
4.8 MEDIUM· v3
2.1 LOW· v2
The Contact Form Email WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and escaping via the name parameter found in the ~/trunk/cp-admin-int-list.inc.php file which allo...Show more
The Contact Form Email WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and escaping via the name parameter found in the ~/trunk/cp-admin-int-list.inc.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.3.24. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.Show less
CVE-2020-9372
1Codepeople
1Appointment Booking Calendar
Jun 17, 2026
Mar 4, 2020
N/A· v4
7.8 HIGH· v3
6.8 MEDIUM· v2
The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or Name) in any booking form to be any formula, which then could be exported via the Bookings list tab...Show more
The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or Name) in any booking form to be any formula, which then could be exported via the Bookings list tab in /wp-admin/admin.php?page=cpabc_appointments.php. The attacker could achieve remote code execution via CSV injection.Show less
CVE-2020-9371
1Codepeople
1Appointment Booking Calendar
Jun 17, 2026
Mar 4, 2020
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
Stored XSS exists in the Appointment Booking Calendar plugin before 1.3.35 for WordPress. In the cpabc_appointments.php file, the Calendar Name input could allow attackers to inject arbitrary JavaScript or HTML.
CVE-2020-7228
1Codepeople
1Calculated Fields Form
Jun 17, 2026
Jan 22, 2020
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
The Calculated Fields Form plugin through 1.0.353 for WordPress suffers from multiple Stored XSS vulnerabilities present in the input forms. These can be exploited by an authenticated user.
CVE-2016-10992
1Codepeople
1Music Store
Nov 21, 2024
Sep 17, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The music-store plugin before 1.0.43 for WordPress has XSS via the wp-admin/admin.php?page=music-store-menu-reports from_year parameter.
CVE-2015-9348
1Codepeople
1Sell Downloads
Nov 21, 2024
Aug 27, 2019
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
The sell-downloads plugin before 1.0.8 for WordPress has insufficient restrictions on brute-force guessing of purchase IDs.
CVE-2015-9346
1Codepeople
1Polls Cp
Nov 21, 2024
Aug 27, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The cp-polls plugin before 1.0.5 for WordPress has XSS.
CVE-2014-10395
1Codepeople
1Polls Cp
Nov 21, 2024
Aug 27, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The cp-polls plugin before 1.0.1 for WordPress has XSS in the votes list.
CVE-2016-10916
1Codepeople
1Appointment Booking Calendar
Nov 21, 2024
Aug 22, 2019
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
The appointment-booking-calendar plugin before 1.1.24 for WordPress has SQL injection, a different vulnerability than CVE-2015-7319.
CVE-2016-10909
1Codepeople
1Booking Calendar Contact Form
Nov 21, 2024
Aug 21, 2019
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
The booking-calendar-contact-form plugin before 1.0.24 for WordPress has SQL injection.
CVE-2016-10908
1Codepeople
1Booking Calendar Contact Form
Nov 21, 2024
Aug 21, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The booking-calendar-contact-form plugin before 1.0.24 for WordPress has XSS.
CVE-2019-14784
1Codepeople
1Cp Contact Form With Paypal
Jun 17, 2026
Aug 15, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The "CP Contact Form with PayPal" plugin before 1.2.98 for WordPress has XSS in CSS edition.
CVE-2018-20964
1Codepeople
1Contact Form Email
Nov 21, 2024
Aug 13, 2019
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The contact-form-to-email plugin before 1.2.66 for WordPress has CSRF.
CVE-2018-20963
1Codepeople
1Contact Form Email
Nov 21, 2024
Aug 13, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The contact-form-to-email plugin before 1.2.66 for WordPress has XSS.
CVE-2019-14791
1Codepeople
1Appointment Booking Calendar
Jun 17, 2026
Aug 9, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The Appointment Booking Calendar plugin 1.3.18 for WordPress allows XSS via the wp-admin/admin-post.php editionarea parameter.
CVE-2019-14785
1Codepeople
1Cp Contact Form With Paypal
Jun 17, 2026
Aug 9, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
The "CP Contact Form with PayPal" plugin before 1.2.99 for WordPress has XSS in the publishing wizard via the wp-admin/admin.php?page=cp_contact_form_paypal.php&pwizard=1 cp_contactformpp_id parameter.
CVE-2019-9646
1Codepeople
1Contact Form Email
Jun 17, 2026
Mar 10, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The Contact Form Email plugin before 1.2.66 for WordPress allows wp-admin/admin.php item XSS, related to cp_admin_int_edition.inc.php in the "custom edition area."
CVE-2015-7666
1Codepeople
1Payment Form For Paypal Pro
May 13, 2026
Dec 27, 2017
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Multiple cross-site scripting (XSS) vulnerabilities in the (1) cp_updateMessageItem and (2) cp_deleteMessageItem functions in cp_ppp_admin_int_message_list.inc.php in the Payment Form for PayPal Pro plugin before 1.0.2 f...Show more
Multiple cross-site scripting (XSS) vulnerabilities in the (1) cp_updateMessageItem and (2) cp_deleteMessageItem functions in cp_ppp_admin_int_message_list.inc.php in the Payment Form for PayPal Pro plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the cal parameter.Show less
CVE-2015-9233
1Codepeople
1Cp Contact Form With Paypal
May 13, 2026
Sep 30, 2017
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has CSRF with resultant XSS, related to cp_contactformpp.php and cp_contactformpp_admin_int_list.inc.php.
CVE-2015-7320
1Codepeople
1Appointment Booking Calendar
May 6, 2026
Sep 29, 2015
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Multiple cross-site scripting (XSS) vulnerabilities in cpabc_appointments_admin_int_bookings_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allow remote attackers to inject arbitrary w...Show more
Multiple cross-site scripting (XSS) vulnerabilities in cpabc_appointments_admin_int_bookings_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.Show less