Skip to contentLatepoint – Calendar Booking Plugin For Appointments And Events vulnerabilities
- latepoint – calendar booking plugin for appointments and eventsLatePoint - Calendar Booking Plugin for Appointments and Events <= 5.4.0 - Unauthenticated Stripe PaymentIntent Amount-Binding BypassCVE-2026-53567.5 High
- latepoint – calendar booking plugin for appointments and eventsLatePoint <= 5.6.1 - Missing Authorization to Unauthenticated Arbitrary Customer Data Modification via process_step_customer() Booking Form Customer StepCVE-2026-113985.3 Medium
- latepoint – calendar booking plugin for appointments and eventsLatePoint <= 5.6.2 - Unauthenticated Insecure Direct Object Reference to Arbitrary Creation via 'service_id' ParameterCVE-2026-126575.3 Medium
- latepoint – calendar booking plugin for appointments and eventsLatePoint <= 5.6.3 - Authenticated (Custom+) Privilege Escalation to Administrator via 'order[customer_id]' ParameterCVE-2026-132288.8 High
- latepoint – calendar booking plugin for appointments and eventsLatePoint <= 5.5.1 - Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OsOrdersController::create_or_update + Unauthenticated Customer-Cabinet Password ResetCVE-2026-81767.5 High
- latepoint – calendar booking plugin for appointments and eventsLatePoint <= 5.6.0 - Cross-Site Request Forgery via invoices__change_status ActionCVE-2026-97194.3 Medium
- latepoint – calendar booking plugin for appointments and eventsLatePoint <= 5.3.2 - Cross-Site Request Forgery via 'customer_cabinet__request_cancellation' AJAX RouteCVE-2026-53654.3 Medium
- latepoint – calendar booking plugin for appointments and eventsLatePoint <= 5.5.0 - Unauthenticated Account Takeover via Weak Password Recovery MechanismCVE-2026-76525.3 Medium
- latepoint – calendar booking plugin for appointments and eventsLatePoint <= 5.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Customer Cabinet Profile UpdateCVE-2026-74576.4 Medium
- latepoint – calendar booking plugin for appointments and eventsLatePoint <= 5.5.0 - Unauthenticated Stored Cross-Site Scripting via 'booking_form_page_url' ParameterCVE-2026-73327.2 High
- latepoint – calendar booking plugin for appointments and eventsLatePoint <= 5.4.1 - Authenticated (Agent+) Privilege Escalation to Administrator via 'connect-customer-to-wp-user' AbilityCVE-2026-67418.8 High
- latepoint – calendar booking plugin for appointments and eventsLatePoint <= 5.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Financial Data Exposure via Sequential Invoice IDCVE-2026-52345.3 Medium
- latepoint – calendar booking plugin for appointments and eventsLatePoint <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeCVE-2026-47856.4 Medium
- latepoint – calendar booking plugin for appointments and eventsLatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.7 - Cross-Site Request Forgery in Booking Form Settings Update to Stored Cross-Site ScriptingCVE-2026-23246.1 Medium
- latepoint – calendar booking plugin for appointments and eventsLatePoint <= 5.2.7 - Authenticated (Administrator+) SQL Injection via JSON ImportCVE-2026-14876.5 Medium
- latepoint – calendar booking plugin for appointments and eventsLatePoint <= 5.2.7 - Authenticated (Agent+) Privilege EscalationCVE-2026-15668.8 High
- latepoint – calendar booking plugin for appointments and eventsLatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Cross-Site Request ForgeryCVE-2025-148734.3 Medium
- latepoint – calendar booking plugin for appointments and eventsLatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Missing Authorization to Booking Details ExposureCVE-2026-15375.3 Medium
- latepoint – calendar booking plugin for appointments and eventsLatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Unauthenticated Stored Cross-Site ScriptingCVE-2026-06177.2 High
- latepoint – calendar booking plugin for appointments and eventsLatePoint <= 5.1.94 - Cross-Site Request Forgery to Account Takeover via change_password() FunctionCVE-2025-70528.8 High
- latepoint – calendar booking plugin for appointments and eventsLatePoint <= 5.1.94 - Unauthenticated Authentication Bypass via load_step FunctionCVE-2025-70388.2 High
- latepoint – calendar booking plugin for appointments and eventsLatePoint <= 5.1.94 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeCVE-2025-69416.4 Medium
- latepoint – calendar booking plugin for appointments and eventsLatePoint <= 5.1.94 - Authenticated (Administrator+) Stored Cross-Site ScriptingCVE-2025-68155.5 Medium
- latepoint – calendar booking plugin for appointments and eventsLatepoint <= 5.1.92 - Unauthenticated Insecure Direct Object ReferenceCVE-2025-37695.3 Medium