Codepeople
Monthly
Unauthenticated arbitrary file read affects the Music Store - WordPress eCommerce plugin in all versions up to and including 1.4.7, where the download handler in ms-download.php passes the 'f' parameter into a file path without proper traversal protection, exposing wp-config.php, credential files and any other content readable by the web server process. The only gating requirement is a valid purchase_id token, which per the reported description any visitor can obtain through a single low-cost purchase or a shared download link, so no WordPress account or elevated privilege is needed. There is no CISA KEV listing and no confirmed public exploit code at time of analysis, but the flaw is remotely reachable at low complexity with high confidentiality impact (CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and the plugin's fixed release 1.4.8 is already published.
Stored cross-site scripting in CodePeople's Contact Form Email WordPress plugin through 1.3.68 lets an attacker persist script payloads through form submission fields or form configuration and execute them when a victim, most plausibly an administrator reviewing submissions in wp-admin, views the stored content. The CVSS vector carries PR:N and UI:R, so the reported path is unauthenticated but requires victim interaction; the independent assessment notes the privilege needed to persist the payload is unconfirmed, and practical risk is lower if authentication is required. No public exploit code or CISA KEV confirmation is provided, and the plugin must be installed and active for exposure.
Stored cross-site scripting in the WordPress plugin CP Multi View Events Calendar (CodePeople) in all versions up to and including 1.4.42 lets unauthenticated attackers inject arbitrary JavaScript through the CalendarTitle parameter, which is then rendered without escaping and executes in the browser of any user - including administrators - who later views the poisoned calendar page. Exploitation is conditional on a non-default configuration: a site administrator must have enabled the 'Allow edition in frontend?' option on at least one calendar view, which exposes the unauthenticated event-add endpoint together with a publicly accessible nonce that the attacker uses to submit the malicious title. No public exploit code was identified at the time of analysis and the issue is not listed in CISA KEV, but the 7.2 CVSS score with PR:N (unauthenticated) and scope change (S:C) makes the attack path low-complexity once that frontend-editing setting is active.
Authenticated SQL injection in the Codepeople CP Multi View Event Calendar WordPress plugin (versions through 1.4.41) allows a logged-in user with low-level privileges to feed crafted input into an unsanitized database query, giving the attacker read access to data held in the site's WordPress database and potential limited manipulation of it. Patchstack rates the issue CVSS 3.1 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, CWE-89), and exploitation is contingent on the plugin being installed and active plus a valid account on the site - fully anonymous visitors cannot trigger it, and no public exploit code has been identified at time of analysis.
Reflected cross-site scripting in the codepeople 'Search in Place' WordPress plugin, versions up to and including 1.5.5, lets remote attackers supply input through the plugin's search handling that is echoed back into the generated page without proper neutralization. Because the assessed vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, no attacker authentication is needed, but the payload only executes when a victim follows a crafted link or visits a malicious page; targeting a logged-in administrator maximizes impact since the script runs in the site's origin. No public exploit identified at time of analysis, and the issue is not reported as confirmed actively exploited (CISA KEV); exploitation is limited by the user-interaction requirement.
Stored DOM-based cross-site scripting in the Appointment Hour Booking - Booking Calendar WordPress plugin (all versions up to and including 1.5.97) allows unauthenticated remote attackers to inject arbitrary web scripts via a Booking Form single-line field, which execute when a victim loads the affected Schedule Calendar list page. Exploitation requires the non-default 'list_readmore_numberofwords' Other Parameters setting to be a positive integer; the default value of 0 bypasses the vulnerable decode-and-truncate branch and is not exploitable through this sink. The assessed CVSS is 7.2 with Low confidentiality and Low integrity impact, and no public exploit was identified at time of analysis; overall this is a moderate, conditional web risk rather than an urgent priority.
PHP object injection in the Music Player for WooCommerce WordPress plugin (versions 1.9.1 and earlier) lets an authenticated user who holds the WooCommerce 'Shop manager' capability pass attacker-controlled serialized data into PHP's object deserialization path, which under the right conditions can lead to full compromise of the site's confidentiality, integrity, and availability. The issue requires WooCommerce to be installed and active, and the CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) is driven by the complete C/I/A impact typical of exploitable object injection but is tempered by the elevated PR:H role requirement and by the practical need for a reachable PHP gadget chain. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (not listed in CISA KEV), so real-world risk is concentrated on sites where shop-manager accounts are broadly distributed or not tightly controlled.
Reflected cross-site scripting in the WordPress plugin Calculated Fields Form affects all versions up to and including 5.5.1.1 and allows an unauthenticated remote attacker to execute script in the browser of a user who follows a crafted link or loads a malicious page. The assessed impact is confined to client-side execution inside the target site's origin (low confidentiality and integrity impact, with scope change), and the attack relies on victim interaction, so higher-value outcomes require luring a privileged user such as a site administrator. No public exploit code was identified at time of analysis, the issue is not listed in CISA KEV, and the available intelligence does not confirm a fixed release.
Cross-site scripting in Music Player for WooCommerce plugin version 1.8.9 and earlier allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in victims' browsers when they interact with a crafted link or page. The flaw targets WooCommerce stores running the Codepeople plugin and could enable session hijacking, credential theft, or malicious redirects against store customers or administrators. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated cross-site scripting in the CP Media Player WordPress plugin (versions 1.3.0 and earlier, by Codepeople) allows a remote unauthenticated attacker to inject arbitrary JavaScript into a victim's browser session by tricking them into visiting a crafted URL. Because the CVSS vector indicates a scope change (S:C), successful exploitation affects the victim's browser context beyond the plugin itself - enabling session hijacking, credential theft, or redirection to malicious infrastructure. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Stored/reflected Cross-Site Scripting in the Google Maps CP WordPress plugin (versions 1.2.5 and earlier, vendor CodePeople) lets an unauthenticated attacker inject malicious script that executes in a victim's browser after they interact with a crafted link or page. The flaw carries a CVSS 3.1 base score of 7.1 with a scope change, reflecting impact beyond the vulnerable component into the wider WordPress session. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
SQL injection in the WP Time Slots Booking Form WordPress plugin (versions 1.2.50 and earlier) allows authenticated Subscriber-level users to inject arbitrary SQL into backend database queries. The CVSS 3.1 vector indicates a scope change with high confidentiality impact, meaning an attacker who only holds the lowest WordPress role can read data beyond the plugin's own scope. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Reflected/stored cross-site scripting in the WP Time Slots Booking Form WordPress plugin (versions up to and including 1.2.46) lets remote unauthenticated attackers inject script that executes in a victim's browser after user interaction. The flaw, reported by Patchstack and tracked as EUVD-2026-36994, carries a CVSS 7.1 due to the scope change against the WordPress origin, and no public exploit identified at time of analysis.
CP Contact Form with Paypal through version 1.3.61 contains a blind SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries with network access. An attacker with user-level privileges can exploit this flaw to extract sensitive database information, though no patch is currently available.
Stored cross-site scripting in CP Multi View Events Calendar 1.4.43 and earlier allows any authenticated WordPress user with Subscriber-level access to inject arbitrary script through the calendar 'Subject' parameter, which is stored and executes when a victim views the affected calendar page. The adddetails endpoint is reachable by low-privileged users because the required nonce is localized on published pages carrying the calendar shortcode, and no public exploit was identified at time of analysis. This is a moderate-severity issue (CVSS 6.4) with limited confidentiality and integrity impact under a changed-scope vector.
Stored cross-site scripting in the Appointment Booking Calendar WordPress plugin through version 1.4.05 allows authenticated users to inject arbitrary web scripts via the 'vs_text_submitbtn' parameter; the payload is stored and executes when a user accesses the injected page. Subscriber-level exploitation is possible only when an administrator has assigned the attacker as a calendar owner ('conwer') through the plugin’s calendar list screen, a non-default grant the UI allows for any registered user; otherwise the flaw requires editor-level access or above. The CVSS 3.1 score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), and no public exploit was identified at time of analysis.
Reflected DOM-based cross-site scripting in the Calculated Fields Form - AI Form Builder for WordPress plugin (all versions up to and including 5.5.1.5) lets unauthenticated attackers inject arbitrary script into a page via the plugin's url.<name> predefined field values, with the payload executing in the victim's browser once the victim clicks an attacker-supplied crafted link. Exploitation is not possible on default installs: the site must publish a publicly reachable form in which an administrator has bound at least two fields to url.<name> predefined values and used those values together in a concatenation equation, so a successful attack depends on a specific non-universal admin configuration plus victim user interaction. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis, and the independently assessed vector (AC:H, UI:R, scope changed) places this in the moderate-priority range rather than an emergency.
Reflected DOM-based cross-site scripting in the Calculated Fields Form - AI Form Builder for WordPress plugin (all versions up to and including 5.5.1.3) allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by luring them to a crafted link, provided the targeted form contains a Text Area field configured with a 'url.<name>' Predefined Value and predefinedClick disabled - a documented, commonly used but per-form configuration the attacker does not control. With a CVSS of 4.7 (AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N), the practical risk against arbitrary installs is limited by that configuration prerequisite and the required user interaction, and the impact is scoped to the victim's session rather than the server. No public exploit code was identified at time of analysis and the vulnerability is not listed in CISA KEV.
Reflected DOM-based cross-site scripting in the CodePeople Calculated Fields Form plugin for WordPress (all versions up to and including 5.5.1.3) allows unauthenticated attackers to execute arbitrary script in a victim's browser, but only on sites that have been specifically configured to expose the flaw. The issue is conditional rather than a default-configuration defect: the site must host a public form with a Select2-enabled dropdown whose choices are built by a calculated equation that pipes a URL parameter through GETURLPARAMETER() into setChoices({texts:[...]}); where that wiring exists, a single crafted link is enough to trigger script execution when a user clicks it. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation; the assessed severity is moderate (CVSS 6.1), with impact confined to the victim's session (C:L/I:L/A:N) and victim interaction required (UI:R).
Broken access control in the Appointment Hour Booking WordPress plugin (by Codepeople) versions up to and including 1.5.91 permits unauthenticated remote attackers to bypass authorization checks, resulting in unauthorized integrity and availability impact. Reported by Patchstack and tracked as EUVD-2026-60933, the flaw requires no credentials, no user interaction, and no special configuration - any network-reachable WordPress installation running an affected plugin version is exposed. No public exploit or KEV listing is identified at time of analysis, though the low attack complexity and zero privilege requirement make opportunistic exploitation straightforward if the plugin is widely scanned for.
Stored Cross-Site Scripting in the Appointment Hour Booking WordPress plugin (versions <= 1.5.86) allows authenticated contributors to inject and persist malicious JavaScript payloads that execute in the browsers of higher-privileged users, such as site administrators, who view the affected content. The CVSS vector (PR:L/UI:R/S:C) confirms this is a contributor-tier stored XSS with scope change, meaning the impact propagates beyond the attacker's own session into the administrative context. No active exploitation has been confirmed via CISA KEV, and no public exploit code has been identified at time of analysis.
Sensitive PII exposure in the Appointment Booking Calendar WordPress plugin (versions up to and including 1.4.02) allows any authenticated user with contributor-level access to retrieve customer booking records - including names, email addresses, phone numbers, and appointment comments - via the unprotected `cpabc_appointments_filter_list` AJAX action. The root cause is CWE-862 (Missing Authorization): the endpoint performs no capability check before returning data, meaning the attacker's only prerequisite is a valid WordPress login at contributor tier or above. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but a source-level fix appears committed in the plugin's SVN repository (changeset 3581633).
Stored Cross-Site Scripting in the CodePeople Post Map for Google Maps WordPress plugin (versions through 1.2.6) permits authenticated Contributor-level users to persist malicious JavaScript payloads via the 'cpm_point' post meta field. The CVSS S:C (Scope Changed) flag confirms the injected scripts execute in victim browser sessions beyond the plugin's own context, enabling session hijacking, credential theft, or unauthorized admin actions against any user who visits an injected page. No confirmed active exploitation appears in CISA KEV, and no public exploit code has been identified at time of analysis.
Sensitive customer PII exposure in the Appointment Booking Calendar WordPress plugin (versions up to and including 1.4.01) allows any authenticated user with Contributor-level access to exfiltrate booking records from calendars they do not own. The root cause is an IDOR (Insecure Direct Object Reference) in the cpabc_appointments_calendar_load2() function: the function enforces only a broad role check (edit_posts capability) without verifying that the requesting user owns the calendar ID supplied via the id parameter. Exposed records include customer names, email addresses, phone numbers, booking times, and freeform comments, making this a meaningful PII breach risk on multi-author WordPress installations. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.
Insecure Direct Object Reference in Booking Calendar Contact Form plugin for WordPress (all versions up to 1.2.63) allows authenticated attackers with Subscriber-level privileges to hijack other users' calendars and access associated user data by exploiting missing validation on user-controlled keys in the dex_bccf_admin_int_calendar_list.inc.php file. The CVSS score of 5.3 reflects network-accessible exploitation without user interaction, though the vulnerability requires valid WordPress authentication at Subscriber level or higher.
Improper access control in Contact Form Email plugin version 1.3.63 and earlier allows authenticated attackers to modify or inject unauthorized data through inadequately restricted endpoints. An attacker with low-privilege access can exploit misconfigured security levels to manipulate form submissions or sensitive information without proper authorization checks.
A Stored Cross-Site Scripting (XSS) vulnerability exists in the CodePeople CP Multi View Event Calendar WordPress plugin through version 1.4.35, allowing authenticated or unauthenticated attackers to inject malicious JavaScript that persists in the database and executes in the browsers of site visitors. This CWE-79 vulnerability enables attackers to steal session cookies, redirect users to malicious sites, or perform actions on behalf of administrators. While no CVSS score or EPSS data are currently published and the vulnerability has not been designated as actively exploited in CISA's KEV catalog, the nature of stored XSS combined with the plugin's event calendar functionality-which typically accepts user input for event creation and editing-indicates a credible attack surface.
WP Time Slots Booking Form through version 1.2.42 contains a missing authorization vulnerability that allows unauthenticated attackers to modify booking data through improperly configured access controls. An attacker can exploit this to alter time slot reservations and other critical booking information without authentication. No patch is currently available for this vulnerability.
Medium severity vulnerability in WordPress plugin. The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form settings in all versions up to, and including, 5.4.5.0. This is due to insufficient capability checks on the form settings save handler and insufficient input sanitization of the `fcontent` field in `fhtml` field types. This makes it possible for authenticated attackers, with Contributor-le...
Cross-Site Request Forgery (CSRF) in Calculated Fields Form for WordPress allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying form settings or deleting data. The vulnerability affects versions up to 5.3.58 and requires user interaction. No public exploit or active exploitation has been identified.
The Polls CP WordPress plugin before 1.0.77 does not sanitise and escape some of its poll settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Polls CP WordPress plugin before 1.0.77 does not sanitise and escape some of its poll settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Calculated Fields Form WordPress plugin before 5.2.64 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Calculated Fields Form WordPress plugin before 5.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Calculated Fields Form WordPress plugin before 5.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Missing Authorization vulnerability in codepeople Appointment Booking Calendar allows Accessing Functionality Not Properly Constrained by ACLs.3.92. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in codepeople Appointment Booking Calendar allows SQL Injection.3.92. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodePeople Contact Form Email allows Stored XSS.3.52. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Form Builder CP plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'CP_EASY_FORM_WILL_APPEAR_HERE' shortcode in all versions up to, and including, 1.2.41 due to. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.1.23 export settings functionality exports data to a public folder, with an easily guessable file name,. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Calculated Fields Form plugin for WordPress is vulnerable to Denial of Service in all versions up to, and including, 5.2.63. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Missing Authorization vulnerability in codepeople WP Time Slots Booking Form wp-time-slots-booking-form allows Exploiting Incorrectly Configured Access Control Security Levels.1.82. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Calculated Fields Form plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 5.2.45. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The Smart Image Gallery WordPress plugin before 1.0.19 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Missing Authorization vulnerability in CodePeople WP Time Slots Booking Form.2.11. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in CodePeople WP Time Slots Booking Form.2.06. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CodePeople WP Time Slots Booking Form allows Stored XSS.2.10. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SQL injection vulnerability in Music Store - WordPress eCommerce versions prior to 1.1.14 allows a remote authenticated attacker with an administrative privilege to execute arbitrary SQL commands. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in CodePeople Contact Form Email.3.44. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodePeople Calculated Fields Form allows Reflected XSS.2.54. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in CodePeople Google Maps CP.0.43. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Appointment Booking Calendar WordPress plugin before 1.3.83 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form page href parameter in all versions up to, and including, 5.1.56 due to insufficient input. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's CP_CALCULATED_FIELDS shortcode in all versions up to, and including, 1.2.52 due to. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Missing Authorization vulnerability in CodePeople WP Time Slots Booking Form.1.76. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CodePeople Calculated Fields Form.2.28. Rated medium severity (CVSS 4.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Contact Form Email WordPress plugin before 1.3.44 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Contact Form Email WordPress plugin before 1.3.38 does not escape submitted values before displaying them in the HTML, leading to a Stored XSS vulnerability. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in Appointment Booking Calendar plugin <= 1.3.69 on WordPress. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Form Builder CP WordPress plugin before 1.2.32 does not sanitise and escape some of its form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The WP Time Slots Booking Form WordPress plugin before 1.1.63 does not sanitise and escape Calendar names, allowing high privilege users to perform Cross-Site Scripting attacks even when the. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Contact Form Email WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and escaping via the name parameter found in the. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or Name) in any booking form to be any formula, which then could be exported via. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Stored XSS exists in the Appointment Booking Calendar plugin before 1.3.35 for WordPress. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Calculated Fields Form plugin through 1.0.353 for WordPress suffers from multiple Stored XSS vulnerabilities present in the input forms. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The "CP Contact Form with PayPal" plugin before 1.2.98 for WordPress has XSS in CSS edition. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Appointment Booking Calendar plugin 1.3.18 for WordPress allows XSS via the wp-admin/admin-post.php editionarea parameter. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The "CP Contact Form with PayPal" plugin before 1.2.99 for WordPress has XSS in the publishing wizard via the wp-admin/admin.php?page=cp_contact_form_paypal.php&pwizard=1 cp_contactformpp_id. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Contact Form Email plugin before 1.2.66 for WordPress allows wp-admin/admin.php item XSS, related to cp_admin_int_edition.inc.php in the "custom edition area.". Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in the (1) cp_updateMessageItem and (2) cp_deleteMessageItem functions in cp_ppp_admin_int_message_list.inc.php in the Payment Form for PayPal Pro. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has CSRF with resultant XSS, related to cp_contactformpp.php and. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in cpabc_appointments_admin_int_bookings_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allow remote attackers. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
SQL injection vulnerability in cpabc_appointments_admin_int_calendar_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allows remote attackers to execute arbitrary. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity.
Multiple cross-site scripting (XSS) vulnerabilities in tmpl/layout_editevent.php in the Multi Calendar (com_multicalendar) component 4.0.2, and possibly 4.8.5 and earlier, for Joomla!. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Unauthenticated arbitrary file read affects the Music Store - WordPress eCommerce plugin in all versions up to and including 1.4.7, where the download handler in ms-download.php passes the 'f' parameter into a file path without proper traversal protection, exposing wp-config.php, credential files and any other content readable by the web server process. The only gating requirement is a valid purchase_id token, which per the reported description any visitor can obtain through a single low-cost purchase or a shared download link, so no WordPress account or elevated privilege is needed. There is no CISA KEV listing and no confirmed public exploit code at time of analysis, but the flaw is remotely reachable at low complexity with high confidentiality impact (CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and the plugin's fixed release 1.4.8 is already published.
Stored cross-site scripting in CodePeople's Contact Form Email WordPress plugin through 1.3.68 lets an attacker persist script payloads through form submission fields or form configuration and execute them when a victim, most plausibly an administrator reviewing submissions in wp-admin, views the stored content. The CVSS vector carries PR:N and UI:R, so the reported path is unauthenticated but requires victim interaction; the independent assessment notes the privilege needed to persist the payload is unconfirmed, and practical risk is lower if authentication is required. No public exploit code or CISA KEV confirmation is provided, and the plugin must be installed and active for exposure.
Stored cross-site scripting in the WordPress plugin CP Multi View Events Calendar (CodePeople) in all versions up to and including 1.4.42 lets unauthenticated attackers inject arbitrary JavaScript through the CalendarTitle parameter, which is then rendered without escaping and executes in the browser of any user - including administrators - who later views the poisoned calendar page. Exploitation is conditional on a non-default configuration: a site administrator must have enabled the 'Allow edition in frontend?' option on at least one calendar view, which exposes the unauthenticated event-add endpoint together with a publicly accessible nonce that the attacker uses to submit the malicious title. No public exploit code was identified at the time of analysis and the issue is not listed in CISA KEV, but the 7.2 CVSS score with PR:N (unauthenticated) and scope change (S:C) makes the attack path low-complexity once that frontend-editing setting is active.
Authenticated SQL injection in the Codepeople CP Multi View Event Calendar WordPress plugin (versions through 1.4.41) allows a logged-in user with low-level privileges to feed crafted input into an unsanitized database query, giving the attacker read access to data held in the site's WordPress database and potential limited manipulation of it. Patchstack rates the issue CVSS 3.1 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, CWE-89), and exploitation is contingent on the plugin being installed and active plus a valid account on the site - fully anonymous visitors cannot trigger it, and no public exploit code has been identified at time of analysis.
Reflected cross-site scripting in the codepeople 'Search in Place' WordPress plugin, versions up to and including 1.5.5, lets remote attackers supply input through the plugin's search handling that is echoed back into the generated page without proper neutralization. Because the assessed vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, no attacker authentication is needed, but the payload only executes when a victim follows a crafted link or visits a malicious page; targeting a logged-in administrator maximizes impact since the script runs in the site's origin. No public exploit identified at time of analysis, and the issue is not reported as confirmed actively exploited (CISA KEV); exploitation is limited by the user-interaction requirement.
Stored DOM-based cross-site scripting in the Appointment Hour Booking - Booking Calendar WordPress plugin (all versions up to and including 1.5.97) allows unauthenticated remote attackers to inject arbitrary web scripts via a Booking Form single-line field, which execute when a victim loads the affected Schedule Calendar list page. Exploitation requires the non-default 'list_readmore_numberofwords' Other Parameters setting to be a positive integer; the default value of 0 bypasses the vulnerable decode-and-truncate branch and is not exploitable through this sink. The assessed CVSS is 7.2 with Low confidentiality and Low integrity impact, and no public exploit was identified at time of analysis; overall this is a moderate, conditional web risk rather than an urgent priority.
PHP object injection in the Music Player for WooCommerce WordPress plugin (versions 1.9.1 and earlier) lets an authenticated user who holds the WooCommerce 'Shop manager' capability pass attacker-controlled serialized data into PHP's object deserialization path, which under the right conditions can lead to full compromise of the site's confidentiality, integrity, and availability. The issue requires WooCommerce to be installed and active, and the CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) is driven by the complete C/I/A impact typical of exploitable object injection but is tempered by the elevated PR:H role requirement and by the practical need for a reachable PHP gadget chain. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (not listed in CISA KEV), so real-world risk is concentrated on sites where shop-manager accounts are broadly distributed or not tightly controlled.
Reflected cross-site scripting in the WordPress plugin Calculated Fields Form affects all versions up to and including 5.5.1.1 and allows an unauthenticated remote attacker to execute script in the browser of a user who follows a crafted link or loads a malicious page. The assessed impact is confined to client-side execution inside the target site's origin (low confidentiality and integrity impact, with scope change), and the attack relies on victim interaction, so higher-value outcomes require luring a privileged user such as a site administrator. No public exploit code was identified at time of analysis, the issue is not listed in CISA KEV, and the available intelligence does not confirm a fixed release.
Cross-site scripting in Music Player for WooCommerce plugin version 1.8.9 and earlier allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in victims' browsers when they interact with a crafted link or page. The flaw targets WooCommerce stores running the Codepeople plugin and could enable session hijacking, credential theft, or malicious redirects against store customers or administrators. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated cross-site scripting in the CP Media Player WordPress plugin (versions 1.3.0 and earlier, by Codepeople) allows a remote unauthenticated attacker to inject arbitrary JavaScript into a victim's browser session by tricking them into visiting a crafted URL. Because the CVSS vector indicates a scope change (S:C), successful exploitation affects the victim's browser context beyond the plugin itself - enabling session hijacking, credential theft, or redirection to malicious infrastructure. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Stored/reflected Cross-Site Scripting in the Google Maps CP WordPress plugin (versions 1.2.5 and earlier, vendor CodePeople) lets an unauthenticated attacker inject malicious script that executes in a victim's browser after they interact with a crafted link or page. The flaw carries a CVSS 3.1 base score of 7.1 with a scope change, reflecting impact beyond the vulnerable component into the wider WordPress session. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
SQL injection in the WP Time Slots Booking Form WordPress plugin (versions 1.2.50 and earlier) allows authenticated Subscriber-level users to inject arbitrary SQL into backend database queries. The CVSS 3.1 vector indicates a scope change with high confidentiality impact, meaning an attacker who only holds the lowest WordPress role can read data beyond the plugin's own scope. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Reflected/stored cross-site scripting in the WP Time Slots Booking Form WordPress plugin (versions up to and including 1.2.46) lets remote unauthenticated attackers inject script that executes in a victim's browser after user interaction. The flaw, reported by Patchstack and tracked as EUVD-2026-36994, carries a CVSS 7.1 due to the scope change against the WordPress origin, and no public exploit identified at time of analysis.
CP Contact Form with Paypal through version 1.3.61 contains a blind SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries with network access. An attacker with user-level privileges can exploit this flaw to extract sensitive database information, though no patch is currently available.
Stored cross-site scripting in CP Multi View Events Calendar 1.4.43 and earlier allows any authenticated WordPress user with Subscriber-level access to inject arbitrary script through the calendar 'Subject' parameter, which is stored and executes when a victim views the affected calendar page. The adddetails endpoint is reachable by low-privileged users because the required nonce is localized on published pages carrying the calendar shortcode, and no public exploit was identified at time of analysis. This is a moderate-severity issue (CVSS 6.4) with limited confidentiality and integrity impact under a changed-scope vector.
Stored cross-site scripting in the Appointment Booking Calendar WordPress plugin through version 1.4.05 allows authenticated users to inject arbitrary web scripts via the 'vs_text_submitbtn' parameter; the payload is stored and executes when a user accesses the injected page. Subscriber-level exploitation is possible only when an administrator has assigned the attacker as a calendar owner ('conwer') through the plugin’s calendar list screen, a non-default grant the UI allows for any registered user; otherwise the flaw requires editor-level access or above. The CVSS 3.1 score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), and no public exploit was identified at time of analysis.
Reflected DOM-based cross-site scripting in the Calculated Fields Form - AI Form Builder for WordPress plugin (all versions up to and including 5.5.1.5) lets unauthenticated attackers inject arbitrary script into a page via the plugin's url.<name> predefined field values, with the payload executing in the victim's browser once the victim clicks an attacker-supplied crafted link. Exploitation is not possible on default installs: the site must publish a publicly reachable form in which an administrator has bound at least two fields to url.<name> predefined values and used those values together in a concatenation equation, so a successful attack depends on a specific non-universal admin configuration plus victim user interaction. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis, and the independently assessed vector (AC:H, UI:R, scope changed) places this in the moderate-priority range rather than an emergency.
Reflected DOM-based cross-site scripting in the Calculated Fields Form - AI Form Builder for WordPress plugin (all versions up to and including 5.5.1.3) allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by luring them to a crafted link, provided the targeted form contains a Text Area field configured with a 'url.<name>' Predefined Value and predefinedClick disabled - a documented, commonly used but per-form configuration the attacker does not control. With a CVSS of 4.7 (AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N), the practical risk against arbitrary installs is limited by that configuration prerequisite and the required user interaction, and the impact is scoped to the victim's session rather than the server. No public exploit code was identified at time of analysis and the vulnerability is not listed in CISA KEV.
Reflected DOM-based cross-site scripting in the CodePeople Calculated Fields Form plugin for WordPress (all versions up to and including 5.5.1.3) allows unauthenticated attackers to execute arbitrary script in a victim's browser, but only on sites that have been specifically configured to expose the flaw. The issue is conditional rather than a default-configuration defect: the site must host a public form with a Select2-enabled dropdown whose choices are built by a calculated equation that pipes a URL parameter through GETURLPARAMETER() into setChoices({texts:[...]}); where that wiring exists, a single crafted link is enough to trigger script execution when a user clicks it. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation; the assessed severity is moderate (CVSS 6.1), with impact confined to the victim's session (C:L/I:L/A:N) and victim interaction required (UI:R).
Broken access control in the Appointment Hour Booking WordPress plugin (by Codepeople) versions up to and including 1.5.91 permits unauthenticated remote attackers to bypass authorization checks, resulting in unauthorized integrity and availability impact. Reported by Patchstack and tracked as EUVD-2026-60933, the flaw requires no credentials, no user interaction, and no special configuration - any network-reachable WordPress installation running an affected plugin version is exposed. No public exploit or KEV listing is identified at time of analysis, though the low attack complexity and zero privilege requirement make opportunistic exploitation straightforward if the plugin is widely scanned for.
Stored Cross-Site Scripting in the Appointment Hour Booking WordPress plugin (versions <= 1.5.86) allows authenticated contributors to inject and persist malicious JavaScript payloads that execute in the browsers of higher-privileged users, such as site administrators, who view the affected content. The CVSS vector (PR:L/UI:R/S:C) confirms this is a contributor-tier stored XSS with scope change, meaning the impact propagates beyond the attacker's own session into the administrative context. No active exploitation has been confirmed via CISA KEV, and no public exploit code has been identified at time of analysis.
Sensitive PII exposure in the Appointment Booking Calendar WordPress plugin (versions up to and including 1.4.02) allows any authenticated user with contributor-level access to retrieve customer booking records - including names, email addresses, phone numbers, and appointment comments - via the unprotected `cpabc_appointments_filter_list` AJAX action. The root cause is CWE-862 (Missing Authorization): the endpoint performs no capability check before returning data, meaning the attacker's only prerequisite is a valid WordPress login at contributor tier or above. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but a source-level fix appears committed in the plugin's SVN repository (changeset 3581633).
Stored Cross-Site Scripting in the CodePeople Post Map for Google Maps WordPress plugin (versions through 1.2.6) permits authenticated Contributor-level users to persist malicious JavaScript payloads via the 'cpm_point' post meta field. The CVSS S:C (Scope Changed) flag confirms the injected scripts execute in victim browser sessions beyond the plugin's own context, enabling session hijacking, credential theft, or unauthorized admin actions against any user who visits an injected page. No confirmed active exploitation appears in CISA KEV, and no public exploit code has been identified at time of analysis.
Sensitive customer PII exposure in the Appointment Booking Calendar WordPress plugin (versions up to and including 1.4.01) allows any authenticated user with Contributor-level access to exfiltrate booking records from calendars they do not own. The root cause is an IDOR (Insecure Direct Object Reference) in the cpabc_appointments_calendar_load2() function: the function enforces only a broad role check (edit_posts capability) without verifying that the requesting user owns the calendar ID supplied via the id parameter. Exposed records include customer names, email addresses, phone numbers, booking times, and freeform comments, making this a meaningful PII breach risk on multi-author WordPress installations. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.
Insecure Direct Object Reference in Booking Calendar Contact Form plugin for WordPress (all versions up to 1.2.63) allows authenticated attackers with Subscriber-level privileges to hijack other users' calendars and access associated user data by exploiting missing validation on user-controlled keys in the dex_bccf_admin_int_calendar_list.inc.php file. The CVSS score of 5.3 reflects network-accessible exploitation without user interaction, though the vulnerability requires valid WordPress authentication at Subscriber level or higher.
Improper access control in Contact Form Email plugin version 1.3.63 and earlier allows authenticated attackers to modify or inject unauthorized data through inadequately restricted endpoints. An attacker with low-privilege access can exploit misconfigured security levels to manipulate form submissions or sensitive information without proper authorization checks.
A Stored Cross-Site Scripting (XSS) vulnerability exists in the CodePeople CP Multi View Event Calendar WordPress plugin through version 1.4.35, allowing authenticated or unauthenticated attackers to inject malicious JavaScript that persists in the database and executes in the browsers of site visitors. This CWE-79 vulnerability enables attackers to steal session cookies, redirect users to malicious sites, or perform actions on behalf of administrators. While no CVSS score or EPSS data are currently published and the vulnerability has not been designated as actively exploited in CISA's KEV catalog, the nature of stored XSS combined with the plugin's event calendar functionality-which typically accepts user input for event creation and editing-indicates a credible attack surface.
WP Time Slots Booking Form through version 1.2.42 contains a missing authorization vulnerability that allows unauthenticated attackers to modify booking data through improperly configured access controls. An attacker can exploit this to alter time slot reservations and other critical booking information without authentication. No patch is currently available for this vulnerability.
Medium severity vulnerability in WordPress plugin. The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form settings in all versions up to, and including, 5.4.5.0. This is due to insufficient capability checks on the form settings save handler and insufficient input sanitization of the `fcontent` field in `fhtml` field types. This makes it possible for authenticated attackers, with Contributor-le...
Cross-Site Request Forgery (CSRF) in Calculated Fields Form for WordPress allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying form settings or deleting data. The vulnerability affects versions up to 5.3.58 and requires user interaction. No public exploit or active exploitation has been identified.
The Polls CP WordPress plugin before 1.0.77 does not sanitise and escape some of its poll settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Polls CP WordPress plugin before 1.0.77 does not sanitise and escape some of its poll settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Calculated Fields Form WordPress plugin before 5.2.64 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Calculated Fields Form WordPress plugin before 5.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Calculated Fields Form WordPress plugin before 5.2.62 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Missing Authorization vulnerability in codepeople Appointment Booking Calendar allows Accessing Functionality Not Properly Constrained by ACLs.3.92. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in codepeople Appointment Booking Calendar allows SQL Injection.3.92. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodePeople Contact Form Email allows Stored XSS.3.52. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Form Builder CP plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'CP_EASY_FORM_WILL_APPEAR_HERE' shortcode in all versions up to, and including, 1.2.41 due to. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
The Appointment Booking Calendar Plugin and Scheduling Plugin WordPress plugin before 1.1.23 export settings functionality exports data to a public folder, with an easily guessable file name,. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Calculated Fields Form plugin for WordPress is vulnerable to Denial of Service in all versions up to, and including, 5.2.63. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Missing Authorization vulnerability in codepeople WP Time Slots Booking Form wp-time-slots-booking-form allows Exploiting Incorrectly Configured Access Control Security Levels.1.82. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Calculated Fields Form plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 5.2.45. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The Smart Image Gallery WordPress plugin before 1.0.19 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Missing Authorization vulnerability in CodePeople WP Time Slots Booking Form.2.11. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in CodePeople WP Time Slots Booking Form.2.06. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CodePeople WP Time Slots Booking Form allows Stored XSS.2.10. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SQL injection vulnerability in Music Store - WordPress eCommerce versions prior to 1.1.14 allows a remote authenticated attacker with an administrative privilege to execute arbitrary SQL commands. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in CodePeople Contact Form Email.3.44. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodePeople Calculated Fields Form allows Reflected XSS.2.54. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in CodePeople Google Maps CP.0.43. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Appointment Booking Calendar WordPress plugin before 1.3.83 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form page href parameter in all versions up to, and including, 5.1.56 due to insufficient input. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's CP_CALCULATED_FIELDS shortcode in all versions up to, and including, 1.2.52 due to. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Missing Authorization vulnerability in CodePeople WP Time Slots Booking Form.1.76. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CodePeople Calculated Fields Form.2.28. Rated medium severity (CVSS 4.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Contact Form Email WordPress plugin before 1.3.44 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Contact Form Email WordPress plugin before 1.3.38 does not escape submitted values before displaying them in the HTML, leading to a Stored XSS vulnerability. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Auth. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing Authorization vulnerability in Appointment Booking Calendar plugin <= 1.3.69 on WordPress. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Form Builder CP WordPress plugin before 1.2.32 does not sanitise and escape some of its form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The WP Time Slots Booking Form WordPress plugin before 1.1.63 does not sanitise and escape Calendar names, allowing high privilege users to perform Cross-Site Scripting attacks even when the. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Contact Form Email WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and escaping via the name parameter found in the. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Appointment Booking Calendar plugin before 1.3.35 for WordPress allows user input (in fields such as Description or Name) in any booking form to be any formula, which then could be exported via. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Stored XSS exists in the Appointment Booking Calendar plugin before 1.3.35 for WordPress. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Calculated Fields Form plugin through 1.0.353 for WordPress suffers from multiple Stored XSS vulnerabilities present in the input forms. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The "CP Contact Form with PayPal" plugin before 1.2.98 for WordPress has XSS in CSS edition. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Appointment Booking Calendar plugin 1.3.18 for WordPress allows XSS via the wp-admin/admin-post.php editionarea parameter. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The "CP Contact Form with PayPal" plugin before 1.2.99 for WordPress has XSS in the publishing wizard via the wp-admin/admin.php?page=cp_contact_form_paypal.php&pwizard=1 cp_contactformpp_id. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Contact Form Email plugin before 1.2.66 for WordPress allows wp-admin/admin.php item XSS, related to cp_admin_int_edition.inc.php in the "custom edition area.". Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in the (1) cp_updateMessageItem and (2) cp_deleteMessageItem functions in cp_ppp_admin_int_message_list.inc.php in the Payment Form for PayPal Pro. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has CSRF with resultant XSS, related to cp_contactformpp.php and. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in cpabc_appointments_admin_int_bookings_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allow remote attackers. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
SQL injection vulnerability in cpabc_appointments_admin_int_calendar_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 for WordPress allows remote attackers to execute arbitrary. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity.
Multiple cross-site scripting (XSS) vulnerabilities in tmpl/layout_editevent.php in the Multi Calendar (com_multicalendar) component 4.0.2, and possibly 4.8.5 and earlier, for Joomla!. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.