Codepeople Form Builder CP vulnerabilities

3 CVEs affecting Codepeople Form Builder CP, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-24672, published 2025-01-24.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-2567, published 2022-09-19. Medium severity, CVSS 4.8. EPSS: 0.6% chance of exploitation in the next 30 days. The Form Builder CP WordPress plugin before 1.2.32 does not sanitise and escape some of its form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting…
CVE-2025-24672, published 2025-01-24. High severity, CVSS 8.5. EPSS: 0.5% chance of exploitation in the next 30 days. Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in codepeople Form Builder CP cp-easy-form-builder allows SQL Injection.This issue affects Form…
CVE-2024-13680, published 2025-01-24. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. The Form Builder CP plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'CP_EASY_FORM_WILL_APPEAR_HERE' shortcode in all versions up to, and including, 1.2.41 due to…