LA
Vendor
latepoint
50
CVEs
0
On KEV
11
New 30D
Products
AB9.1
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
latepoint
14 CVEs0 on KEV11 new
LC8.8
LatePoint – Calendar Booking Plugin for Appointments and Events
latepoint
24 CVEs0 on KEV0 new
LA9.8
LatePoint
Latepoint
9 CVEs0 on KEV0 new
LP9.8
LatePoint Plugin
latepoint
3 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-111602 | AB Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress latepoint | 3.7 | Oct 17 | Appointment Booking Plugin <= 5.7.4 - Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in 'customer[uuid]' Parameter |
| CVE-2026-110653 | AB Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress latepoint | 9.1 | Oct 17 | Appointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter |
| CVE-2026-103380 | AB Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress latepoint | 4.3 | Oct 14 | Appointment Booking Plugin <= 5.7.3 - Authenticated (Subscriber+) Sensitive Information Exposure in 'first_name' Parameter Template Re-expansion |
| CVE-2026-103366 | AB Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress latepoint | 7.5 | Oct 14 | Appointment Booking Plugin <= 5.7.3 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'booking[id]' and 'cart[id]' Parameters |
| CVE-2026-100163 | AB Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress latepoint | 7.4 | Oct 14 | Appointment Booking Plugin <= 5.7.2 - Unauthenticated Authentication Bypass to Customer Account Takeover via Insufficient Verification in create_wp_user_for_customer() username_exists Fallback |
| CVE-2026-96662 | AB Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress latepoint | 7.5 | Oct 10 | Appointment Booking Plugin <= 5.7.2 - Unauthenticated SQL Injection via 'booking[service_id]' Parameter |
| CVE-2026-104766 | AB Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress latepoint | 8.8 | Oct 10 | Appointment Booking Plugin <= 5.7.3 - Authenticated (Custom+) Privilege Escalation to 'settings[default_wp_role_for_customer]' Parameter |
| CVE-2026-91050 | AB Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress latepoint | 4.3 | Oct 10 | Appointment Booking Plugin <= 5.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Unauthorized Booking Creation and Sensitive Information Disclosure via 'params[presets][order_item_id]' Parameter |
| CVE-2026-17538 | AB Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress latepoint | 5.4 | Oct 7 | Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.6.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification |
| CVE-2026-94432 | AB Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress latepoint | 5.3 | Oct 2 | Appointment Booking Plugin <= 5.7.1 - Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration via 'invoice_id' Parameter |
| CVE-2026-92966 | AB Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress latepoint | 9.1 | Oct 1 | Appointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution via First/Last Name Field |
| CVE-2026-13471 | AB Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress latepoint | 4.3 | Sep 18 | LatePoint <= 5.6.3 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure via Abilities REST API (list-bookings, list-customers, delete-booking) |
| CVE-2026-18441 | AB Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress latepoint | 4.3 | Sep 17 | LatePoint - Appointment Booking & Scheduling <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer[id]' Parameter |
| CVE-2026-5391 | AB Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress latepoint | 6.4 | Aug 6 | LatePoint <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
| CVE-2026-57714 | LA LatePoint LatePoint | 9.3 | Jul 13 | WordPress LatePoint plugin <= 5.6.3 - SQL Injection vulnerability |
| CVE-2026-5356 | LC LatePoint – Calendar Booking Plugin for Appointments and Events latepoint | 7.5 | Jul 8 | LatePoint - Calendar Booking Plugin for Appointments and Events <= 5.4.0 - Unauthenticated Stripe PaymentIntent Amount-Binding Bypass |
| CVE-2026-11398 | LC LatePoint – Calendar Booking Plugin for Appointments and Events latepoint | 5.3 | Jul 3 | LatePoint <= 5.6.1 - Missing Authorization to Unauthenticated Arbitrary Customer Data Modification via process_step_customer() Booking Form Customer Step |
| CVE-2026-12657 | LC LatePoint – Calendar Booking Plugin for Appointments and Events latepoint | 5.3 | Jul 2 | LatePoint <= 5.6.2 - Unauthenticated Insecure Direct Object Reference to Arbitrary Creation via 'service_id' Parameter |
| CVE-2026-13228 | LC LatePoint – Calendar Booking Plugin for Appointments and Events latepoint | 8.8 | Jul 1 | LatePoint <= 5.6.3 - Authenticated (Custom+) Privilege Escalation to Administrator via 'order[customer_id]' Parameter |
| CVE-2026-8176 | LC LatePoint – Calendar Booking Plugin for Appointments and Events latepoint | 7.5 | Jun 16 | LatePoint <= 5.5.1 - Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OsOrdersController::create_or_update + Unauthenticated Customer-Cabinet Password Reset |
| CVE-2026-49083 | LA LatePoint LatePoint | 7.5 | Jun 15 | WordPress LatePoint plugin <= 5.5.1 - Privilege Escalation vulnerability |
| CVE-2026-9719 | LC LatePoint – Calendar Booking Plugin for Appointments and Events latepoint | 4.3 | Jun 5 | LatePoint <= 5.6.0 - Cross-Site Request Forgery via invoices__change_status Action |
| CVE-2026-5365 | LC LatePoint – Calendar Booking Plugin for Appointments and Events latepoint | 4.3 | May 14 | LatePoint <= 5.3.2 - Cross-Site Request Forgery via 'customer_cabinet__request_cancellation' AJAX Route |
| CVE-2026-7652 | LC LatePoint – Calendar Booking Plugin for Appointments and Events latepoint | 5.3 | May 9 | LatePoint <= 5.5.0 - Unauthenticated Account Takeover via Weak Password Recovery Mechanism |
| CVE-2026-7332 | LC LatePoint – Calendar Booking Plugin for Appointments and Events latepoint | 7.2 | May 6 | LatePoint <= 5.5.0 - Unauthenticated Stored Cross-Site Scripting via 'booking_form_page_url' Parameter |
| CVE-2026-7457 | LC LatePoint – Calendar Booking Plugin for Appointments and Events latepoint | 6.4 | May 6 | LatePoint <= 5.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Customer Cabinet Profile Update |
| CVE-2026-6741 | LC LatePoint – Calendar Booking Plugin for Appointments and Events latepoint | 8.8 | Apr 27 | LatePoint <= 5.4.1 - Authenticated (Agent+) Privilege Escalation to Administrator via 'connect-customer-to-wp-user' Ability |
| CVE-2026-5234 | LC LatePoint – Calendar Booking Plugin for Appointments and Events latepoint | 5.3 | Apr 17 | LatePoint <= 5.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Financial Data Exposure via Sequential Invoice ID |
| CVE-2026-4785 | LC LatePoint – Calendar Booking Plugin for Appointments and Events latepoint | 6.4 | Apr 8 | LatePoint <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
| CVE-2026-32533 | LA LatePoint LatePoint | 6.5 | Mar 25 | WordPress LatePoint plugin <= 5.2.6 - Insecure Direct Object References (IDOR) vulnerability |
| CVE-2026-2324 | LC LatePoint – Calendar Booking Plugin for Appointments and Events latepoint | 6.1 | Mar 11 | LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.7 - Cross-Site Request Forgery in Booking Form Settings Update to Stored Cross-Site Scripting |
| CVE-2026-1487 | LC LatePoint – Calendar Booking Plugin for Appointments and Events latepoint | 6.5 | Mar 3 | LatePoint <= 5.2.7 - Authenticated (Administrator+) SQL Injection via JSON Import |
| CVE-2026-1566 | LC LatePoint – Calendar Booking Plugin for Appointments and Events latepoint | 8.8 | Mar 2 | LatePoint <= 5.2.7 - Authenticated (Agent+) Privilege Escalation |
| CVE-2025-14873 | LC LatePoint – Calendar Booking Plugin for Appointments and Events latepoint | 4.3 | Feb 14 | LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Cross-Site Request Forgery |
| CVE-2026-1537 | LC LatePoint – Calendar Booking Plugin for Appointments and Events latepoint | 5.3 | Feb 12 | LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Missing Authorization to Booking Details Exposure |
| CVE-2026-0617 | LC LatePoint – Calendar Booking Plugin for Appointments and Events latepoint | 7.2 | Feb 3 | LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Unauthenticated Stored Cross-Site Scripting |
| CVE-2025-7052 | LC LatePoint – Calendar Booking Plugin for Appointments and Events latepoint | 8.8 | Sep 30 | LatePoint <= 5.1.94 - Cross-Site Request Forgery to Account Takeover via change_password() Function |
| CVE-2025-7038 | LC LatePoint – Calendar Booking Plugin for Appointments and Events latepoint | 8.2 | Sep 30 | LatePoint <= 5.1.94 - Unauthenticated Authentication Bypass via load_step Function |
| CVE-2025-6941 | LC LatePoint – Calendar Booking Plugin for Appointments and Events latepoint | 6.4 | Sep 30 | LatePoint <= 5.1.94 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
| CVE-2025-6815 | LC LatePoint – Calendar Booking Plugin for Appointments and Events latepoint | 5.5 | Sep 30 | LatePoint <= 5.1.94 - Authenticated (Administrator+) Stored Cross-Site Scripting |
| CVE-2025-3769 | LC LatePoint – Calendar Booking Plugin for Appointments and Events latepoint | 5.3 | May 14 | Latepoint <= 5.1.92 - Unauthenticated Insecure Direct Object Reference |
| CVE-2025-30836 | LA LatePoint LatePoint | 6.5 | Mar 27 | WordPress LatePoint plugin <= 5.1.6 - Cross Site Scripting (XSS) vulnerability |
| CVE-2024-43945 | LA LatePoint Latepoint | 8.8 | Oct 21 | WordPress LatePoint plugin <= 4.9.91 - Cross Site Request Forgery (CSRF) vulnerability |
| CVE-2024-8943 | LP LatePoint Plugin latepoint | 9.8 | Oct 8 | LatePoint <= 5.0.12 - Authentication Bypass |
| CVE-2024-8911 | LP LatePoint Plugin latepoint | 9.8 | Oct 8 | LatePoint <= 5.0.11 - Unauthenticated Arbitrary User Password Change via SQL Injection |
| CVE-2024-43992 | LA LatePoint Latepoint | 5.4 | Sep 17 | WordPress LatePoint plugin <= 4.9.91 - Cross Site Scripting (XSS) vulnerability |
| CVE-2024-2472 | LP LatePoint Plugin latepoint | 9.1 | Jun 14 | LatePoint Plugin <= 4.9.9 - Missing Authorization and Sensitive Information Exposure via IDOR |