Latepoint Latepoint vulnerabilities

• latepoint appointment booking plugin – latepoint | calendar & scheduling for wordpress Appointment Booking Plugin <= 5.7.6 - Unauthenticated Authentication Bypass via Account Takeover via 'IS NOT NULL' Sentinel in 'password_reset_token' Parameter CVE-2026-118066 9.1 CriticalNovember 7, 2026
• latepoint appointment booking plugin – latepoint | calendar & scheduling for wordpress Appointment Booking Plugin <= 5.7.6 - Unauthenticated Stored Cross-Site Scripting via Customer Email Field CVE-2026-119152 5.4 MediumNovember 7, 2026
• latepoint LatePoint < 5.7.5 - Unauthenticated Payment Bypass via 'payment_portion' Parameter CVE-2026-105256 5.3 MediumOctober 21, 2026
• latepoint appointment booking plugin – latepoint | calendar & scheduling for wordpress Appointment Booking Plugin <= 5.7.4 - Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in 'customer[uuid]' Parameter CVE-2026-111602 3.7 LowOctober 17, 2026
• latepoint appointment booking plugin – latepoint | calendar & scheduling for wordpress Appointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter CVE-2026-110653 9.1 CriticalOctober 17, 2026
• latepoint appointment booking plugin – latepoint | calendar & scheduling for wordpress Appointment Booking Plugin <= 5.7.3 - Authenticated (Subscriber+) Sensitive Information Exposure in 'first_name' Parameter Template Re-expansion CVE-2026-103380 4.3 MediumOctober 14, 2026
• latepoint appointment booking plugin – latepoint | calendar & scheduling for wordpress Appointment Booking Plugin <= 5.7.3 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'booking[id]' and 'cart[id]' Parameters CVE-2026-103366 7.5 HighOctober 14, 2026
• latepoint appointment booking plugin – latepoint | calendar & scheduling for wordpress Appointment Booking Plugin <= 5.7.2 - Unauthenticated Authentication Bypass to Customer Account Takeover via Insufficient Verification in create_wp_user_for_customer() username_exists Fallback CVE-2026-100163 7.4 HighOctober 14, 2026
• latepoint appointment booking plugin – latepoint | calendar & scheduling for wordpress Appointment Booking Plugin <= 5.7.2 - Unauthenticated SQL Injection via 'booking[service_id]' Parameter CVE-2026-96662 7.5 HighOctober 10, 2026
• latepoint appointment booking plugin – latepoint | calendar & scheduling for wordpress Appointment Booking Plugin <= 5.7.3 - Authenticated (Custom+) Privilege Escalation to 'settings[default_wp_role_for_customer]' Parameter CVE-2026-104766 8.8 HighOctober 10, 2026
• latepoint appointment booking plugin – latepoint | calendar & scheduling for wordpress Appointment Booking Plugin <= 5.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Unauthorized Booking Creation and Sensitive Information Disclosure via 'params[presets][order_item… CVE-2026-91050 4.3 MediumOctober 10, 2026
• latepoint appointment booking plugin – latepoint | calendar & scheduling for wordpress Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.6.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification CVE-2026-17538 5.4 MediumOctober 7, 2026
• latepoint appointment booking plugin – latepoint | calendar & scheduling for wordpress Appointment Booking Plugin <= 5.7.1 - Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration via 'invoice_id' Parameter CVE-2026-94432 5.3 MediumOctober 2, 2026
• latepoint appointment booking plugin – latepoint | calendar & scheduling for wordpress Appointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution via First/Last Name Field CVE-2026-92966 Public exploit 9.1 CriticalOctober 1, 2026
• latepoint appointment booking plugin – latepoint | calendar & scheduling for wordpress LatePoint <= 5.6.3 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure via Abilities REST API (list-bookings, list-customers,… CVE-2026-13471 4.3 MediumSeptember 18, 2026
• latepoint appointment booking plugin – latepoint | calendar & scheduling for wordpress LatePoint - Appointment Booking & Scheduling <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer[id]' Parameter CVE-2026-18441 4.3 MediumSeptember 17, 2026
• latepoint appointment booking plugin – latepoint | calendar & scheduling for wordpress LatePoint <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes CVE-2026-5391 6.4 MediumAugust 6, 2026
• latepoint WordPress LatePoint plugin <= 5.6.3 - SQL Injection vulnerability CVE-2026-57714 9.3 CriticalJuly 13, 2026
• latepoint – calendar booking plugin for appointments and events LatePoint - Calendar Booking Plugin for Appointments and Events <= 5.4.0 - Unauthenticated Stripe PaymentIntent Amount-Binding Bypass CVE-2026-5356 7.5 HighJuly 8, 2026
• latepoint – calendar booking plugin for appointments and events LatePoint <= 5.6.1 - Missing Authorization to Unauthenticated Arbitrary Customer Data Modification via process_step_customer() Booking Form Customer Step CVE-2026-11398 5.3 MediumJuly 3, 2026
• latepoint – calendar booking plugin for appointments and events LatePoint <= 5.6.2 - Unauthenticated Insecure Direct Object Reference to Arbitrary Creation via 'service_id' Parameter CVE-2026-12657 5.3 MediumJuly 2, 2026
• latepoint – calendar booking plugin for appointments and events LatePoint <= 5.6.3 - Authenticated (Custom+) Privilege Escalation to Administrator via 'order[customer_id]' Parameter CVE-2026-13228 8.8 HighJuly 1, 2026
• latepoint – calendar booking plugin for appointments and events LatePoint <= 5.5.1 - Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OsOrdersController::create_or_update + Unauthenticated Customer-Cabinet Password Reset CVE-2026-8176 7.5 HighJune 16, 2026
• latepoint WordPress LatePoint plugin <= 5.5.1 - Privilege Escalation vulnerability CVE-2026-49083 Public exploit 7.5 HighJune 15, 2026
• latepoint – calendar booking plugin for appointments and events LatePoint <= 5.6.0 - Cross-Site Request Forgery via invoices__change_status Action CVE-2026-9719 4.3 MediumJune 5, 2026
• latepoint – calendar booking plugin for appointments and events LatePoint <= 5.3.2 - Cross-Site Request Forgery via 'customer_cabinet__request_cancellation' AJAX Route CVE-2026-5365 4.3 MediumMay 14, 2026
• latepoint – calendar booking plugin for appointments and events LatePoint <= 5.5.0 - Unauthenticated Account Takeover via Weak Password Recovery Mechanism CVE-2026-7652 5.3 MediumMay 9, 2026
• latepoint – calendar booking plugin for appointments and events LatePoint <= 5.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Customer Cabinet Profile Update CVE-2026-7457 6.4 MediumMay 6, 2026
• latepoint – calendar booking plugin for appointments and events LatePoint <= 5.5.0 - Unauthenticated Stored Cross-Site Scripting via 'booking_form_page_url' Parameter CVE-2026-7332 7.2 HighMay 6, 2026
• latepoint – calendar booking plugin for appointments and events LatePoint <= 5.4.1 - Authenticated (Agent+) Privilege Escalation to Administrator via 'connect-customer-to-wp-user' Ability CVE-2026-6741 Public exploit 8.8 HighApril 27, 2026
• latepoint – calendar booking plugin for appointments and events LatePoint <= 5.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Financial Data Exposure via Sequential Invoice ID CVE-2026-5234 5.3 MediumApril 17, 2026
• latepoint – calendar booking plugin for appointments and events LatePoint <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2026-4785 6.4 MediumApril 8, 2026
• latepoint WordPress LatePoint plugin <= 5.2.6 - Insecure Direct Object References (IDOR) vulnerability CVE-2026-32533 6.5 MediumMarch 25, 2026
• latepoint – calendar booking plugin for appointments and events LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.7 - Cross-Site Request Forgery in Booking Form Settings Update to Stored Cross-Site Scripting CVE-2026-2324 6.1 MediumMarch 11, 2026
• latepoint – calendar booking plugin for appointments and events LatePoint <= 5.2.7 - Authenticated (Administrator+) SQL Injection via JSON Import CVE-2026-1487 6.5 MediumMarch 3, 2026
• latepoint – calendar booking plugin for appointments and events LatePoint <= 5.2.7 - Authenticated (Agent+) Privilege Escalation CVE-2026-1566 8.8 HighMarch 2, 2026
• latepoint – calendar booking plugin for appointments and events LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Cross-Site Request Forgery CVE-2025-14873 4.3 MediumFebruary 14, 2026
• latepoint – calendar booking plugin for appointments and events LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Missing Authorization to Booking Details Exposure CVE-2026-1537 5.3 MediumFebruary 12, 2026
• latepoint – calendar booking plugin for appointments and events LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Unauthenticated Stored Cross-Site Scripting CVE-2026-0617 7.2 HighFebruary 3, 2026
• latepoint – calendar booking plugin for appointments and events LatePoint <= 5.1.94 - Cross-Site Request Forgery to Account Takeover via change_password() Function CVE-2025-7052 8.8 HighSeptember 30, 2025
• latepoint – calendar booking plugin for appointments and events LatePoint <= 5.1.94 - Unauthenticated Authentication Bypass via load_step Function CVE-2025-7038 8.2 HighSeptember 30, 2025
• latepoint – calendar booking plugin for appointments and events LatePoint <= 5.1.94 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2025-6941 6.4 MediumSeptember 30, 2025
• latepoint – calendar booking plugin for appointments and events LatePoint <= 5.1.94 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2025-6815 5.5 MediumSeptember 30, 2025
• latepoint Latepoint < 5.1.94 - Unauthenticated LFI CVE-2025-6715 9.8 CriticalAugust 13, 2025
• latepoint – calendar booking plugin for appointments and events Latepoint <= 5.1.92 - Unauthenticated Insecure Direct Object Reference CVE-2025-3769 5.3 MediumMay 14, 2025
• latepoint WordPress LatePoint plugin <= 5.1.6 - Cross Site Scripting (XSS) vulnerability CVE-2025-30836 6.5 MediumMarch 27, 2025
• latepoint WordPress LatePoint plugin <= 4.9.91 - Cross Site Request Forgery (CSRF) vulnerability CVE-2024-43945 6.5 MediumOctober 21, 2024
• latepoint, latepoint plugin +1 more LatePoint <= 5.0.12 - Authentication Bypass CVE-2024-8943 9.8 CriticalOctober 8, 2024
• latepoint, latepoint plugin +1 more LatePoint <= 5.0.11 - Unauthenticated Arbitrary User Password Change via SQL Injection CVE-2024-8911 9.8 CriticalOctober 8, 2024
• latepoint WordPress LatePoint plugin <= 4.9.91 - Cross Site Scripting (XSS) vulnerability CVE-2024-43992 6.5 MediumSeptember 17, 2024
• Show olderLoading…