Codepeople
Vulnerability activity for Codepeople: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 7
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 10
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 10
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 6.4MediumOct 30, 2026Codepeople CP Multi View Events Calendar XSSCVE-2026-119176The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Subject' parameter in all versions up to, and including, 1.4.43 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The required nonce is localized to any published page carrying the calend
- 6.4MediumOct 28, 2026Codepeople Appointment Booking Calendar XSSCVE-2026-111727The Appointment Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vs_text_submitbtn' parameter in all versions up to, and including, 1.4.05 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to be assigned as a calendar owner, a
- 7.5HighOct 23, 2026Codepeople Music Store – WordPress eCommerce Path traversal / file handlingCVE-2026-115497The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.4.7 via the 'f' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires a valid purchase_id token, which any user can obtain by making a single low-cost purchase or receiving a shared download link.
- 7.1HighOct 22, 2026Codepeople Contact Form Email XSSCVE-2026-112379Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codepeople Contact Form Email contact-form-to-email allows Stored XSS.This issue affects Contact Form Email: from n/a through 1.3.68.
- 7.2HighOct 16, 2026Codepeople CP Multi View Events Calendar XSSCVE-2026-110701The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'CalendarTitle' parameter in all versions up to, and including, 1.4.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires that an administrator has enabled the "Allow edition in frontend?" option on at least one ca
- 8.5HighOct 14, 2026Codepeople CP Multi View Event Calendar SQL injectionCVE-2026-109901Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Codepeople CP Multi View Event Calendar cp-multi-view-calendar allows SQL Injection.This issue affects CP Multi View Event Calendar : from n/a through 1.4.41.
- 7.1HighOct 9, 2026Codepeople Search in Place XSSCVE-2026-95598Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Search in Place search-in-place allows Reflected XSS.This issue affects Search in Place: from n/a through 1.5.5.
- 6.1MediumOct 3, 2026Codepeople Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More XSSCVE-2026-103909The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'arbitrary (whichever names the admin bound via url.<name>)' parameter in all versions up to, and including, 5.5.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick
- 7.2HighSep 30, 2026Codepeople Music Player for WooCommerce DeserializationCVE-2026-93624Shop manager PHP Object Injection in Music Player for WooCommerce <= 1.9.1 versions.
- 7.1HighSep 23, 2026Codepeople Calculated Fields Form XSSCVE-2026-95529Unauthenticated Cross Site Scripting (XSS) in Calculated Fields Form <= 5.5.1.1 versions.
Top products
- CP Multi View Events Calendar2 CVEs in the last year
- Search in Place1 CVE in the last year
- Music Store – WordPress eCommerce1 CVE in the last year
- Music Player for WooCommerce1 CVE in the last year
- CP Multi View Event Calendar1 CVE in the last year
- Contact Form Email1 CVE in the last year
- Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More1 CVE in the last year
- Calculated Fields Form1 CVE in the last year
- Appointment Booking Calendar1 CVE in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.