WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
latepoint
Published
2026-10-06
Title
LatePoint < 5.6.5 - Agent+ Arbitrary Order, Customer and Transaction Deletion via IDOR
Slug
latepoint
Published
2026-10-06
Title
LatePoint < 5.6.9 - Agent+ Cross-Agent Data Disclosure and Modification via Abilities API
Slug
latepoint
Published
2026-10-06
Title
LatePoint < 5.7.3 - Unauthenticated Customer PII Disclosure via IDOR
Slug
latepoint
Published
2026-10-07
Title
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress < 5.6.10 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification
Slug
latepoint
Published
2026-10-09
Title
Appointment Booking Plugin < 5.7.3 - Insecure Direct Object Reference to Authenticated (Subscriber+) Unauthorized Booking Creation and Sensitive Information Disclosure via 'params[presets][order_item_id]' Parameter
Slug
latepoint
Published
2026-10-09
Title
LatePoint < 5.7.4 - Authenticated Privilege Escalation via the 'settings[default_wp_role_for_customer]' Parameter
Slug
latepoint
Published
2026-10-13
Title
Appointment Booking Plugin < 5.7.4 - Authenticated (Subscriber+) Sensitive Information Exposure in 'first_name' Parameter Template Re-expansion
Slug
latepoint
Published
2026-10-13
Title
LatePoint < 5.7.4 - Unauthenticated Sensitive Information Disclosure via IDOR in 'booking[id]' and 'cart[id]' Parameters
Slug
latepoint
Published
2026-10-13
Title
LatePoint < 5.7.3 - Subscriber+ Authentication Bypass to Customer Account Takeover via username_exists Fallback
Slug
latepoint
Published
2026-10-16
Title
Appointment Booking Plugin < 5.7.5 - Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in 'customer[uuid]' Parameter
Slug
latepoint
Published
2026-10-16
Title
LatePoint < 5.7.5 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter
Slug
latepoint
Published
2026-10-19
Title
LatePoint < 5.7.5 - Agent+ Customer PII Disclosure via IDOR
Slug
latepoint
Published
2026-10-19
Title
LatePoint < 5.7.5 - Unauthenticated Payment Bypass via 'payment_portion' Parameter
Slug
latepoint
Published
2026-10-27
Title
LatePoint < 5.7.6 - Admin+ Stored XSS via Booking Form Step Settings
Slug
latest-custom-post-type-updates
Published
2025-04-03
Title
Latest Custom Post Type Updates <= 1.3.0 - Reflected Cross-Site Scripting
Slug
latest-post-accordian-slider
Published
2025-07-21
Title
Latest Post Accordian Slider <= 1.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
latest-post-shortcode
Published
2025-09-03
Title
Latest Post Shortcode < 14.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
latest-post-shortcode
Published
2026-01-24
Title
Latest Post Shortcode < 14.2.1 - Missing Authorization
Slug
latest-post-shortcode
Published
2026-02-03
Title
Latest Post Shortcode < 14.2.2 - Missing Authorization
Slug
latest-registered-users
Published
2026-01-06
Title
Latest Registered Users <= 1.4 - Missing Authorization to Unauthenticated Sensitive Information Exposure via User Data Export
Slug
latest-tweets-widget
Published
2022-05-18
Title
Latest Tweets Widget <= 1.1.4 - Arbitrary Settings Update via CSRF
Slug
latestcheckins
Published
2025-08-15
Title
LatestCheckins <= 1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Slug
latex
Published
2022-05-23
Title
LaTeX for WordPress <= 3.4.10 - Arbitrary Settings Update via CSRF to Stored XSS
Slug
latex2html
Published
2024-10-21
Title
LaTeX2HTML < 2.5.5 - Reflected Cross-Site Scripting
Slug
latex2html
Published
2024-12-20
Title
LaTeX2HTML < 2.6.0 - Reflected Cross-Site Scripting