Log in Start free

CodePeople

Products

ProductCVEsExploitedLatest
Calculated Fields Form12–Sep 23, 2026
WP Time Slots Booking Form11–Jun 15, 2026
Contact Form Email8–Oct 22, 2026
Appointment Booking Calendar7–Oct 28, 2026
Booking Calendar Contact Form6–Apr 24, 2026
Appointment Hour Booking – Booking Calendar5–Oct 1, 2026
CP Multi View Event Calendar5–Oct 14, 2026
CP Polls4–Jun 20, 2025
Appointment Hour Booking4–Aug 18, 2026
Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More3–Oct 3, 2026
Music Player for WooCommerce3–Sep 30, 2026
CP Contact Form with PayPal3–Mar 13, 2026
Search in Place2–Oct 9, 2026
Google Maps CP2–Jul 2, 2026
CP Media Player2–Aug 27, 2026
Form Builder CP2–Jan 24, 2025
CP Multi View Events Calendar2–Oct 30, 2026
Appointment Booking Calendar (WordPress plugin)1–Nov 18, 2022
CodePeople Post Map for Google Maps1–Jun 27, 2026
Corner Ad1–Dec 15, 2022
CP Blocks1–Oct 6, 2023
CP Image Store with Slideshow1–Jan 13, 2026
Music Store1–Jan 27, 2025
Music Store – WordPress eCommerce1–Oct 23, 2026
Music Store - WordPress eCommerce1–Jun 7, 2024
Payment Form for PayPal Pro1–Apr 17, 2025
Sell Downloads1–Jan 5, 2026
Appointment Hour Booking (WordPress plugin)1–Nov 18, 2022

Exploited and recent CVEs

  • CVE-2026-119176 Medium 6.4 CP Multi View Events Calendar <= 1.4.43 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'Subject' Parameter 0.3%
  • CVE-2026-111727 Medium 6.4 Appointment Booking Calendar <= 1.4.05 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'vs_text_submitbtn' Parameter 0.2%
  • CVE-2026-115497 High 7.5 Music Store <= 1.4.7 - Unauthenticated Arbitrary File Read via 'f' Parameter 0.9%
  • CVE-2026-112379 High 7.1 WordPress Contact Form Email plugin <= 1.3.68 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-110701 High 7.2 CP Multi View Events Calendar <= 1.4.42 - Unauthenticated Stored Cross-Site Scripting via 'CalendarTitle' Parameter 0.2%
  • CVE-2026-109901 High 8.5 WordPress CP Multi View Event Calendar plugin <= 1.4.41 - SQL Injection vulnerability 0.3%
  • CVE-2026-95598 High 7.1 WordPress Search in Place plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-103909 Medium 6.1 Calculated Fields Form <= 5.5.1.5 - Reflected DOM-Based Cross-Site Scripting via URL Parameter Substitution in Calculated Field Equation 0.3%
  • CVE-2026-100184 Medium 4.7 Calculated Fields Form <= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting via 'x' URL Query Parameter via Text Area Predefined Value 0.2%
  • CVE-2026-96573 High 7.2 Appointment Hour Booking <= 1.5.97 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer 0.3%
  • CVE-2026-100179 Medium 6.1 Calculated Fields Form <= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting via 'x' URL Parameter via setChoices() 0.2%
  • CVE-2026-93624 High 7.2 WordPress Music Player for WooCommerce plugin <= 1.9.1 - PHP Object Injection vulnerability 0.4%
  • CVE-2026-95529 High 7.1 WordPress Calculated Fields Form plugin <= 5.5.1.1 - Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2026-78283 High 7.1 WordPress Music Player for WooCommerce plugin <= 1.8.9 - Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2026-78281 High 7.1 WordPress CP Media Player plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2026-66679 Medium 6.5 WordPress Appointment Hour Booking plugin <= 1.5.91 - Broken Access Control vulnerability 0.4%
  • CVE-2026-65514 Medium 6.5 WordPress Appointment Hour Booking plugin <= 1.5.86 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-57670 High 7.1 WordPress Google Maps CP plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2026-12113 Medium 4.3 Appointment Booking Calendar <= 1.4.02 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure 0.4%
  • CVE-2026-13335 Medium 6.4 CodePeople Post Map for Google Maps <= 1.2.6 - Authenticated (Contributor +) Stored Cross-Site Scripting via 'cpm_point' Post Meta 0.4%
  • CVE-2026-12111 Medium 4.3 Appointment Booking Calendar <= 1.4.01 - Authenticated (Contributor+) Sensitive Information Exposure via 'id' Parameter 0.3%
  • CVE-2026-48882 High 8.5 WordPress WP Time Slots Booking Form plugin <= 1.2.50 - SQL Injection vulnerability 0.3%
  • CVE-2026-40791 High 7.1 WordPress WP Time Slots Booking Form plugin <= 1.2.46 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-6810 Medium 5.3 Booking Calendar Contact Form <= 1.2.63 - Authenticated (Subscriber+) Insecure Direct Object Reference to Calendar Takeover 0.3%
  • CVE-2026-32483 Medium 6.5 WordPress Contact Form Email plugin <= 1.3.63 - Broken Access Control vulnerability 0.3%
  • CVE-2026-25465 Medium 6.5 WordPress CP Multi View Event Calendar plugin <= 1.4.36 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-32433 High 8.5 WordPress CP Contact Form with Paypal plugin <= 1.3.61 - SQL Injection vulnerability 0.2%
  • CVE-2026-32432 Medium 5.3 WordPress WP Time Slots Booking Form plugin <= 1.2.42 - Broken Access Control vulnerability 0.2%
  • CVE-2026-3986 Medium 6.4 Calculated Fields Form <= 5.4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Form Settings 0.2%
  • CVE-2026-25368 Medium 6.5 WordPress Calculated Fields Form plugin <= 5.4.4.1 - Broken Access Control vulnerability 0.3%