CVE-2025-68850

WordPress Sell Downloads plugin <= 1.1.12 - Broken Access Control vulnerability

Missing Authorization vulnerability in codepeople Sell Downloads sell-downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sell Downloads: from n/a through <= 1.1.12.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Codepeople Wordpress

Products

Sell Downloads Wordpress

CVE-2025-39562

WordPress Payment Form for PayPal Pro plugin <= 1.1.72 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Payment Form for PayPal Pro payment-form-for-paypal-pro allows Stored XSS.This issue affects Payment Form for PayPal Pro: from n/a through <= 1.1.72.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Codepeople

Products

Payment Form For Paypal Pro

CVE-2024-31302

WordPress Contact Form Email plugin <= 1.3.44 - Sensitive Data Exposure vulnerability

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in CodePeople Contact Form Email.This issue affects Contact Form Email: from n/a through 1.3.44.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Codepeople

Products

Contact Form Email

CVE-2023-51517

WordPress Calculated Fields Form Plugin <= 1.2.28 is vulnerable to Open Redirection

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CodePeople Calculated Fields Form.This issue affects Calculated Fields Form: from n/a through 1.2.28.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed

Vendors

Codepeople

Products

Calculated Fields Form

CVE-2023-25039

WordPress Google Maps CP plugin <= 1.0.43 - Missing Authorization Leading To Feedback Submission Vulnerability

Missing Authorization vulnerability in CodePeople Google Maps CP.This issue affects Google Maps CP: from n/a through 1.0.43.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Codepeople Wordpress

Products

Google Maps Cp Wordpress

CVE-2023-25037

WordPress Booking Calendar Contact Form plugin <= 1.2.34 - Broken Access Control vulnerability

Missing Authorization vulnerability in CodePeople Booking Calendar Contact Form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking Calendar Contact Form: from n/a through 1.2.34.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Codepeople Wordpress

Products

Booking Calendar Contact Form Wordpress

CVE-2023-23895

WordPress WP Time Slots Booking Form plugin <= 1.1.82 - Broken Access Control vulnerability

Missing Authorization vulnerability in CodePeople WP Time Slots Booking Form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Time Slots Booking Form: from n/a through 1.1.82.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Codepeople

Products

Wp Time Slots Booking Form

CVE-2026-25465

WordPress CP Multi View Event Calendar plugin <= 1.4.36 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople CP Multi View Event Calendar cp-multi-view-calendar allows Stored XSS.This issue affects CP Multi View Event Calendar : from n/a through <= 1.4.36.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Codepeople Wordpress

Products

Cp Multi View Event Calendar Wordpress

CVE-2024-33543

WordPress WP Time Slots Booking Form plugin <= 1.2.06 - Broken Access Control vulnerability

Missing Authorization vulnerability in CodePeople WP Time Slots Booking Form.This issue affects WP Time Slots Booking Form: from n/a through 1.2.06.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Codepeople

Products

Wp Time Slots Booking Form

CVE-2024-29759

WordPress Calculated Fields Form plugin <= 1.2.54 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodePeople Calculated Fields Form allows Reflected XSS.This issue affects Calculated Fields Form: from n/a through 1.2.54.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Codepeople

Products

Calculated Fields Form

CVE-2022-41790

WordPress WP Time Slots Booking Form Plugin <= 1.1.76 is vulnerable to Broken Access Control

Missing Authorization vulnerability in CodePeople WP Time Slots Booking Form.This issue affects WP Time Slots Booking Form: from n/a through 1.1.76.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Codepeople

Products

Wp Time Slots Booking Form

CVE-2026-6810

Booking Calendar Contact Form <= 1.2.63 - Authenticated (Subscriber+) Insecure Direct Object Reference to Calendar Takeover

The Booking Calendar Contact Form plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.63 via the dex_bccf_admin_int_calendar_list.inc.php file due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to takeover other user's calendars and view user data associated with the calendar.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Codepeople Wordpress

Products

Booking Calendar Contact Form Wordpress

CVE-2025-68569

WordPress WP Time Slots Booking Form plugin <= 1.2.39 - Broken Access Control vulnerability

Missing Authorization vulnerability in codepeople WP Time Slots Booking Form wp-time-slots-booking-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Time Slots Booking Form: from n/a through <= 1.2.39.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Codepeople Wordpress

Products

Wp Time Slots Booking Form Wordpress

CVE-2025-10019

WordPress Contact Form Email plugin <= 1.3.60 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in codepeople Contact Form Email contact-form-to-email allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form Email: from n/a through <= 1.3.60.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Codepeople Wordpress

Products

Contact Form Email Wordpress

CVE-2025-64261

WordPress Appointment Booking Calendar plugin <= 1.3.95 - Broken Access Control vulnerability

Missing Authorization vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Appointment Booking Calendar: from n/a through <= 1.3.95.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Codepeople Wordpress

Products

Appointment Booking Calendar Wordpress

CVE-2025-49332

WordPress WP Time Slots Booking Form plugin <= 1.2.30 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in codepeople WP Time Slots Booking Form wp-time-slots-booking-form allows Cross Site Request Forgery.This issue affects WP Time Slots Booking Form: from n/a through <= 1.2.30.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Codepeople

Products

Wp Time Slots Booking Form

CVE-2025-49291

WordPress Calculated Fields Form plugin <= 5.3.58 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in codepeople Calculated Fields Form calculated-fields-form allows Cross Site Request Forgery.This issue affects Calculated Fields Form: from n/a through <= 5.3.58.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Codepeople

Products

Calculated Fields Form

CVE-2025-48231

WordPress Booking Calendar Contact Form plugin <= 1.2.58 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Booking Calendar Contact Form booking-calendar-contact-form allows Stored XSS.This issue affects Booking Calendar Contact Form: from n/a through <= 1.2.58.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Codepeople Wordpress

Products

Booking Calendar Contact Form Wordpress

CVE-2025-46247

WordPress Appointment Booking Calendar plugin <= 1.3.92 - Broken Access Control Vulnerability

Missing Authorization vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Appointment Booking Calendar: from n/a through <= 1.3.92.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Codepeople

Products

Appointment Booking Calendar

CVE-2025-46241

WordPress Appointment Booking Calendar plugin <= 1.3.92 - CSRF to SQL Injection vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows SQL Injection.This issue affects Appointment Booking Calendar: from n/a through <= 1.3.92.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Codepeople

Products

Appointment Booking Calendar