What’s Vulnerable › Products
LatePoint – Calendar Booking Plugin for Appointments and Events vulnerabilities
24 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 24 published in the last 12 months.
Latest LatePoint – Calendar Booking Plugin for Appointments and Events vulnerabilities
- CVE-2026-5356 — LatePoint - Calendar Booking Plugin for Appointments and Events <= 5.4.0 - Unauthenticated Stripe PaymentIntent Amount-Binding Bypass (CVSS 7.5)
- CVE-2026-11398 — LatePoint <= 5.6.1 - Missing Authorization to Unauthenticated Arbitrary Customer Data Modification via process_step_customer() Booking Form Customer Step (CVSS 5.3)
- CVE-2026-12657 — LatePoint <= 5.6.2 - Unauthenticated Insecure Direct Object Reference to Arbitrary Creation via 'service_id' Parameter (CVSS 5.3)
- CVE-2026-13228 — LatePoint <= 5.6.3 - Authenticated (Custom+) Privilege Escalation to Administrator via 'order[customer_id]' Parameter (CVSS 8.8)
- CVE-2026-8176 — LatePoint <= 5.5.1 - Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OsOrdersController::create_or_update + Unauthenticated Customer-Cabinet Password Reset (CVSS 7.5)
- CVE-2026-9719 — LatePoint <= 5.6.0 - Cross-Site Request Forgery via invoices__change_status Action (CVSS 4.3)
- CVE-2026-5365 — LatePoint <= 5.3.2 - Cross-Site Request Forgery via 'customer_cabinet__request_cancellation' AJAX Route (CVSS 4.3)
- CVE-2026-7652 — LatePoint <= 5.5.0 - Unauthenticated Account Takeover via Weak Password Recovery Mechanism (CVSS 5.3)
- CVE-2026-7457 — LatePoint <= 5.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Customer Cabinet Profile Update (CVSS 6.4)
- CVE-2026-7332 — LatePoint <= 5.5.0 - Unauthenticated Stored Cross-Site Scripting via 'booking_form_page_url' Parameter (CVSS 7.2)
- CVE-2026-6741 — LatePoint <= 5.4.1 - Authenticated (Agent+) Privilege Escalation to Administrator via 'connect-customer-to-wp-user' Ability (CVSS 8.8)
- CVE-2026-5234 — LatePoint <= 5.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Financial Data Exposure via Sequential Invoice ID (CVSS 5.3)
- CVE-2026-4785 — LatePoint <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
- CVE-2026-2324 — LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.7 - Cross-Site Request Forgery in Booking Form Settings Update to Stored Cross-Site Scripting (CVSS 6.1)
- CVE-2026-1487 — LatePoint <= 5.2.7 - Authenticated (Administrator+) SQL Injection via JSON Import (CVSS 6.5)
- CVE-2026-1566 — LatePoint <= 5.2.7 - Authenticated (Agent+) Privilege Escalation (CVSS 8.8)
- CVE-2025-14873 — LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Cross-Site Request Forgery (CVSS 4.3)
- CVE-2026-1537 — LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Missing Authorization to Booking Details Exposure (CVSS 5.3)
- CVE-2026-0617 — LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2)
- CVE-2025-7052 — LatePoint <= 5.1.94 - Cross-Site Request Forgery to Account Takeover via change_password() Function (CVSS 8.8)
- CVE-2025-7038 — LatePoint <= 5.1.94 - Unauthenticated Authentication Bypass via load_step Function (CVSS 8.2)
- CVE-2025-6941 — LatePoint <= 5.1.94 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
- CVE-2025-6815 — LatePoint <= 5.1.94 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 5.5)
- CVE-2025-3769 — Latepoint <= 5.1.92 - Unauthenticated Insecure Direct Object Reference (CVSS 5.3)