Vulnerabilities in codepeople
80 resultsVexday analysis
CodePeople possui 49 vulnerabilidades registradas, com 6 publicadas nos últimos 90 dias, mas nenhuma atualmente sob ataque ativo conhecido (KEV). A ausência de críticas (CVSS ≥9.0) e a dominância de falhas XSS (CWE-79) indicam um perfil de risco moderado, concentrado em vulnerabilidades de aplicação web que demandam contexto de execução. A cadência recente de divulgações merece monitoramento, mas sem sinais imediatos de exploração em massa.
CVE-2024-29759HIGHWordPress Calculated Fields Form plugin <= 1.2.54 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-24873MEDIUMWordPress Polls CP plugin <= 1.0.71 - Polls Limitation Bypass vulnerabilityEPSS 0.4%CVE-2024-33543HIGHWordPress WP Time Slots Booking Form plugin <= 1.2.06 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2024-24874MEDIUMWordPress Polls CP plugin <= 1.0.71 - Content Injection vulnerabilityEPSS 0.4%CVE-2023-36384HIGHWordPress Booking Calendar Contact Form Plugin <= 1.2.40 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2024-35735MEDIUMWordPress WP Time Slots Booking Form plugin <= 1.2.11 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2025-46247MEDIUMWordPress Appointment Booking Calendar plugin <= 1.3.92 - Broken Access Control VulnerabilityEPSS 0.4%CVE-2023-23971MEDIUMWordPress WP Time Slots Booking Form Plugin <= 1.1.81 is vulnerable to Cross Site Scripting (XSS)EPSS 0.4%CVE-2026-12113MEDIUMAppointment Booking Calendar <= 1.4.02 - Missing Authorization to Authenticated (Contributor+) Sensitive Information DisclosureEPSS 0.4%CVE-2024-9940MEDIUMCalculated Fields Form <= 5.2.45 - HTML InjectionEPSS 0.4%CVE-2023-45649MEDIUMWordPress Appointment Hour Booking plugin <= 1.4.23 - Broken Access Control vulnerabilityEPSS 0.4%CVE-2026-13335MEDIUMCodePeople Post Map for Google Maps <= 1.2.6 - Authenticated (Contributor +) Stored Cross-Site Scripting via 'cpm_point' Post MetaEPSS 0.4%CVE-2025-13384HIGHCP Contact Form with PayPal <= 1.3.56 - Missing Authorization to Unauthenticated Arbitrary Payment ConfirmationEPSS 0.4%CVE-2024-32720MEDIUMWordPress Appointment Hour Booking plugin <= 1.4.56 - Captcha Bypass vulnerabilityEPSS 0.4%CVE-2026-66679MEDIUMWordPress Appointment Hour Booking plugin <= 1.5.91 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-48882HIGHWordPress WP Time Slots Booking Form plugin <= 1.2.50 - SQL Injection vulnerabilityEPSS 0.3%CVE-2026-6810MEDIUMBooking Calendar Contact Form <= 1.2.63 - Authenticated (Subscriber+) Insecure Direct Object Reference to Calendar TakeoverEPSS 0.3%CVE-2025-47472MEDIUMWordPress Music Player for WooCommerce plugin <= 1.5.1 - Broken Access Control VulnerabilityEPSS 0.3%CVE-2024-47297HIGHWordPress Polls CP plugin <= 1.0.74 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-24727MEDIUMWordPress Contact Form to Email Plugin <= 1.3.52 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%