Plugin icon

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress

latepoint

Vulnerabilities:

36

Last Updated:

August 2, 2026

Active Installs:

100000

Published
Title
Fixed in
CVSS
Published
2026-08-05
Title
LatePoint < 5.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Fixed in
Fixed in 5.4.0
CVSS
5.5 (medium)
Published
2026-07-10
Title
LatePoint < 5.6.8 - Unauthenticated Booking Object Mass Assignment via Public Booking Funnel
Fixed in
Fixed in 5.6.8
CVSS
5.3 (medium)
Published
2026-07-08
Title
LatePoint < 5.6.4 - Unauthenticated SQL Injection
Fixed in
Fixed in 5.6.4
CVSS
8.6 (high)
Published
2026-07-07
Title
LatePoint < 5.4.1 - Unauthenticated Payment Bypass via Client-Supplied Stripe PaymentIntent ID
Fixed in
Fixed in 5.4.1
CVSS
7.5 (high)
Published
2026-07-02
Title
LatePoint < 5.6.2 - Missing Authorization to Unauthenticated Arbitrary Customer Data Modification via process_step_customer() Booking Form Customer Step
Fixed in
Fixed in 5.6.2
CVSS
5.3 (medium)
Published
2026-07-01
Title
LatePoint < 5.6.3 - Unauthenticated Insecure Direct Object Reference to Arbitrary Creation via 'service_id' Parameter
Fixed in
Fixed in 5.6.3
CVSS
5.3 (medium)
Published
2026-06-30
Title
LatePoint < 5.6.4 - Agent+ Privilege Escalation to Administrator via order[customer_id] Parameter
Fixed in
Fixed in 5.6.4
CVSS
7.2 (high)
Published
2026-06-25
Title
LatePoint < 5.6.3 - Multiple Privileged Actions via CSRF
Fixed in
Fixed in 5.6.3
CVSS
5.4 (medium)
Published
2026-06-15
Title
LatePoint < 5.5.2 - Agent+ Privilege Escalation to Administrator
Fixed in
Fixed in 5.5.2
CVSS
7.2 (high)
Published
2026-06-05
Title
LatePoint < 5.6.1 - Cross-Site Request Forgery via invoices__change_status Action
Fixed in
Fixed in 5.6.1
CVSS
4.3 (medium)
Published
2026-06-05
Title
LatePoint < 5.5.2 - Contributor+ Privilege Escalation
Fixed in
Fixed in 5.5.2
CVSS
7.2 (high)
Published
2026-05-13
Title
LatePoint < 5.4.0 - Cross-Site Request Forgery via 'customer_cabinet__request_cancellation' AJAX Route
Fixed in
Fixed in 5.4.0
CVSS
4.3 (medium)
Published
2026-05-08
Title
LatePoint < 5.5.1 - Unauthenticated Account Takeover via Weak Password Recovery Mechanism
Fixed in
Fixed in 5.5.1
CVSS
5.3 (medium)
Published
2026-05-05
Title
LatePoint < 5.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Customer Cabinet Profile Update
Fixed in
Fixed in 5.5.1
CVSS
6.4 (medium)
Published
2026-05-05
Title
LatePoint < 5.5.1 - Unauthenticated Stored Cross-Site Scripting via 'first_name' Parameter
Fixed in
Fixed in 5.5.1
CVSS
7.2 (high)
Published
2026-05-05
Title
LatePoint < 5.5.1 - Unauthenticated Stored Cross-Site Scripting via 'booking_form_page_url' Parameter
Fixed in
Fixed in 5.5.1
CVSS
7.2 (high)
Published
2026-04-27
Title
LatePoint < 5.4.2 - Agent+ Privilege Escalation
Fixed in
Fixed in 5.4.2
CVSS
7.2 (high)
Published
2026-04-16
Title
LatePoint < 5.4.0 - Insecure Direct Object Reference to Unauthenticated Sensitive Financial Data Exposure via Sequential Invoice ID
Fixed in
Fixed in 5.4.0
CVSS
5.3 (medium)
Published
2026-04-07
Title
LatePoint < 5.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Fixed in
Fixed in 5.3.1
CVSS
5.5 (medium)
Published
2026-03-23
Title
LatePoint – Calendar Booking Plugin for Appointments and Events < 5.2.7 - Authenticated (Subscriber+) Insecure Direct Object Reference
Fixed in
Fixed in 5.2.7
CVSS
4.3 (medium)
Published
2026-03-10
Title
LatePoint – Calendar Booking Plugin for Appointments and Events < 5.2.8 - Cross-Site Request Forgery in Booking Form Settings Update to Stored Cross-Site Scripting
Fixed in
Fixed in 5.2.8
CVSS
6.1 (medium)
Published
2026-03-02
Title
LatePoint < 5.2.8 - Authenticated (Administrator+) SQL Injection via JSON Import
Fixed in
Fixed in 5.2.8
CVSS
6.5 (medium)
Published
2026-03-02
Title
LatePoint < 5.2.8 - Agent+ Privilege Escalation
Fixed in
Fixed in 5.2.8
CVSS
7.2 (high)
Published
2026-02-13
Title
LatePoint – Calendar Booking Plugin for Appointments and Events < 5.2.6 - Cross-Site Request Forgery
Fixed in
Fixed in 5.2.6
CVSS
4.3 (medium)
Published
2026-02-11
Title
LatePoint – Calendar Booking Plugin for Appointments and Events < 5.2.7 - Missing Authorization to Booking Details Exposure
Fixed in
Fixed in 5.2.7
CVSS
5.3 (medium)
Published
2026-02-02
Title
LatePoint < 5.2.6 - Unauthenticated Stored XSS
Fixed in
Fixed in 5.2.6
CVSS
7.1 (high)
Published
2025-09-29
Title
LatePoint < 5.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Fixed in
Fixed in 5.2.0
CVSS
6.4 (medium)
Published
2025-09-29
Title
LatePoint < 5.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
Fixed in
Fixed in 5.2.0
CVSS
5.5 (medium)
Published
2025-09-29
Title
LatePoint < 5.2.0 - Unauthenticated Authentication Bypass
Fixed in
Fixed in 5.2.0
CVSS
8.2 (high)
Published
2025-09-29
Title
LatePoint < 5.2.0 - Account Takeover via CSRF
Fixed in
Fixed in 5.2.0
CVSS
8.8 (high)
Published
2025-07-23
Title
Latepoint < 5.1.94 - Unauthenticated LFI
Fixed in
Fixed in 5.1.94
CVSS
6.8 (medium)
Published
2025-05-13
Title
Latepoint < 5.1.93 - Unauthenticated Insecure Direct Object Reference
Fixed in
Fixed in 5.1.93
CVSS
5.3 (medium)
Published
2025-03-27
Title
LatePoint < 5.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Fixed in
Fixed in 5.1.7
CVSS
6.4 (medium)
Published
2024-09-24
Title
LatePoint < 5.0.13 - Authentication Bypass
Fixed in
Fixed in 5.0.13
CVSS
8.1 (high)
Published
2024-09-20
Title
LatePoint < 5.0.12 - Unauthenticated Arbitrary User Password Change via SQL Injection
Fixed in
Fixed in 5.0.12
CVSS
9.8 (critical)
Published
2024-06-13
Title
LatePoint Plugin < 4.9.9.1 - Missing Authorization and Sensitive Information Exposure via IDOR
Fixed in
Fixed in 4.9.9.1
CVSS
9.1 (critical)