CVEs we hold for Latepoint
Records whose assigning authority named Latepoint as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-9719LatePoint <= 5.6.0 - Cross-Site Request Forgery via invoices__change_status ActionLatePoint – Calendar Booking Plugin for Appointments and…
CVE-2026-8176LatePoint <= 5.5.1 - Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in…LatePoint – Calendar Booking Plugin for Appointments and…
CVE-2026-7652LatePoint <= 5.5.0 - Unauthenticated Account Takeover via Weak Password Recovery MechanismLatePoint – Calendar Booking Plugin for Appointments and…
CVE-2026-7457LatePoint <= 5.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Customer Cabinet Profile UpdateLatePoint – Calendar Booking Plugin for Appointments and…
CVE-2026-7332LatePoint <= 5.5.0 - Unauthenticated Stored Cross-Site Scripting via 'booking_form_page_url' ParameterLatePoint – Calendar Booking Plugin for Appointments and…
CVE-2026-6741LatePoint <= 5.4.1 - Authenticated (Agent+) Privilege Escalation to Administrator via 'connect-customer-to-wp-user'…LatePoint – Calendar Booking Plugin for Appointments and…
CVE-2026-5391LatePoint <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesLatePoint | Calendar & Scheduling for WordPress
CVE-2026-5365LatePoint <= 5.3.2 - Cross-Site Request Forgery via 'customer_cabinet__request_cancellation' AJAX RouteLatePoint – Calendar Booking Plugin for Appointments and…
CVE-2026-5356LatePoint - Calendar Booking Plugin for Appointments and Events <= 5.4.0 - Unauthenticated Stripe PaymentIntent…LatePoint – Calendar Booking Plugin for Appointments and…
CVE-2026-5234LatePoint <= 5.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Financial Data Exposure via…LatePoint – Calendar Booking Plugin for Appointments and…
CVE-2026-4785LatePoint <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeLatePoint – Calendar Booking Plugin for Appointments and…
CVE-2026-32533WordPress LatePoint plugin <= 5.2.6 - Insecure Direct Object References (IDOR) vulnerabilityLatePoint
CVE-2026-2324LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.7 - Cross-Site Request Forgery in Booking Form…LatePoint – Calendar Booking Plugin for Appointments and…
CVE-2026-18441LatePoint - Appointment Booking & Scheduling <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive…LatePoint | Calendar & Scheduling for WordPress
CVE-2026-1566LatePoint <= 5.2.7 - Authenticated (Agent+) Privilege EscalationLatePoint – Calendar Booking Plugin for Appointments and…
CVE-2026-1537LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Missing Authorization to Booking Details…LatePoint – Calendar Booking Plugin for Appointments and…
CVE-2026-1487LatePoint <= 5.2.7 - Authenticated (Administrator+) SQL Injection via JSON ImportLatePoint – Calendar Booking Plugin for Appointments and…
CVE-2026-13471LatePoint <= 5.6.3 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and…LatePoint | Calendar & Scheduling for WordPress
CVE-2026-13228LatePoint <= 5.6.3 - Authenticated (Custom+) Privilege Escalation to Administrator via 'order[customer_id]' ParameterLatePoint – Calendar Booking Plugin for Appointments and…
CVE-2026-12657LatePoint <= 5.6.2 - Unauthenticated Insecure Direct Object Reference to Arbitrary Creation via 'service_id' ParameterLatePoint – Calendar Booking Plugin for Appointments and…
CVE-2026-11398LatePoint <= 5.6.1 - Missing Authorization to Unauthenticated Arbitrary Customer Data Modification via…LatePoint – Calendar Booking Plugin for Appointments and…
CVE-2026-0617LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Unauthenticated Stored Cross-Site ScriptingLatePoint – Calendar Booking Plugin for Appointments and…
CVE-2025-7052LatePoint <= 5.1.94 - Cross-Site Request Forgery to Account Takeover via change_password() FunctionLatePoint – Calendar Booking Plugin for Appointments and…
CVE-2025-7038LatePoint <= 5.1.94 - Unauthenticated Authentication Bypass via load_step FunctionLatePoint – Calendar Booking Plugin for Appointments and…
CVE-2025-6941LatePoint <= 5.1.94 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeLatePoint – Calendar Booking Plugin for Appointments and…
CVE-2025-6815LatePoint <= 5.1.94 - Authenticated (Administrator+) Stored Cross-Site ScriptingLatePoint – Calendar Booking Plugin for Appointments and…
CVE-2025-3769Latepoint <= 5.1.92 - Unauthenticated Insecure Direct Object ReferenceLatePoint – Calendar Booking Plugin for Appointments and…
CVE-2025-30836WordPress LatePoint plugin <= 5.1.6 - Cross Site Scripting (XSS) vulnerabilityLatePoint
CVE-2025-14873LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Cross-Site Request ForgeryLatePoint – Calendar Booking Plugin for Appointments and…
CVE-2024-8911LatePoint <= 5.0.11 - Unauthenticated Arbitrary User Password Change via SQL InjectionLatePoint Plugin
CVE-2024-43992WordPress LatePoint plugin <= 4.9.91 - Cross Site Scripting (XSS) vulnerabilityLatePoint
CVE-2024-43945WordPress LatePoint plugin <= 4.9.91 - Cross Site Request Forgery (CSRF) vulnerabilityLatePoint
CVE-2024-2472LatePoint Plugin <= 4.9.9 - Missing Authorization and Sensitive Information Exposure via IDORLatePoint Plugin
37 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.