Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress

Vulnerabilities

• CVE-2026-57714unauthenticated≤ 5.6.3

  WordPress LatePoint plugin <= 5.6.3 - SQL Injection vulnerability

  Critical 9.3

• CVE-2026-92966unauthenticated≤ 5.7.0

  Appointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution via First/Last Name Field

  Critical 9.1

• CVE-2025-7052unauthenticated · needs a click≤ 5.1.94

  LatePoint <= 5.1.94 - Cross-Site Request Forgery to Account Takeover via change_password() Function

  High 8.8

• CVE-2024-43945unauthenticated · needs a click≤ 4.9.91

  WordPress LatePoint plugin <= 4.9.91 - Cross Site Request Forgery (CSRF) vulnerability

  High 8.8

• CVE-2026-13228login required≤ 5.6.3

  LatePoint <= 5.6.3 - Authenticated (Custom+) Privilege Escalation to Administrator via 'order[customer_id]' Parameter

  High 8.8

• CVE-2026-6741login required≤ 5.4.1

  LatePoint <= 5.4.1 - Authenticated (Agent+) Privilege Escalation to Administrator via 'connect-customer-to-wp-user' Ability

  High 8.8

• CVE-2025-7038unauthenticated≤ 5.1.94

  LatePoint <= 5.1.94 - Unauthenticated Authentication Bypass via load_step Function

  High 8.2

• CVE-2026-5356unauthenticated≤ 5.4.0

  LatePoint - Calendar Booking Plugin for Appointments and Events <= 5.4.0 - Unauthenticated Stripe PaymentIntent Amount-Binding Bypass

  High 7.5

• CVE-2026-8176unauthenticated≤ 5.5.1

  LatePoint <= 5.5.1 - Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OsOrdersController::create_or_update + Unauthenticated Customer-Ca

  High 7.5

• CVE-2026-49083contributor+≤ 5.5.1

  WordPress LatePoint plugin <= 5.5.1 - Privilege Escalation vulnerability

  High 7.5

• CVE-2026-7332unauthenticated≤ 5.5.0

  LatePoint <= 5.5.0 - Unauthenticated Stored Cross-Site Scripting via 'booking_form_page_url' Parameter

  High 7.2

• CVE-2026-0617unauthenticated≤ 5.2.5

  LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Unauthenticated Stored Cross-Site Scripting

  High 7.2

• CVE-2026-32533unauthenticated≤ <= 5.2.6

  WordPress LatePoint plugin <= 5.2.6 - Insecure Direct Object References (IDOR) vulnerability

  Medium 6.5

• CVE-2025-30836login required≤ 5.1.6

  WordPress LatePoint plugin <= 5.1.6 - Cross Site Scripting (XSS) vulnerability

  Medium 6.5

• CVE-2026-7457subscriber+≤ 5.5.0

  LatePoint <= 5.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Customer Cabinet Profile Update

  Medium 6.4

• CVE-2026-5391contributor+≤ 5.3.2

  LatePoint <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

  Medium 6.4

• CVE-2026-4785contributor+≤ 5.3.0

  LatePoint <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

  Medium 6.4

• CVE-2025-6941contributor+≤ 5.1.94

  LatePoint <= 5.1.94 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

  Medium 6.4

• CVE-2026-2324unauthenticated · needs a click≤ 5.2.7

  LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.7 - Cross-Site Request Forgery in Booking Form Settings Update to Stored Cross-Site Scrip

  Medium 6.1

• CVE-2025-6815admin≤ 5.1.94

  LatePoint <= 5.1.94 - Authenticated (Administrator+) Stored Cross-Site Scripting

  Medium 5.5

• CVE-2024-43992login required≤ 4.9.91

  WordPress LatePoint plugin <= 4.9.91 - Cross Site Scripting (XSS) vulnerability

  Medium 5.4

• CVE-2026-94432unauthenticated≤ 5.7.1

  Appointment Booking Plugin <= 5.7.1 - Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enum

  Medium 5.3

• CVE-2026-11398unauthenticated≤ 5.6.1

  LatePoint <= 5.6.1 - Missing Authorization to Unauthenticated Arbitrary Customer Data Modification via process_step_customer() Booking Form Customer Step

  Medium 5.3

• CVE-2026-12657unauthenticated≤ 5.6.2

  LatePoint <= 5.6.2 - Unauthenticated Insecure Direct Object Reference to Arbitrary Creation via 'service_id' Parameter

  Medium 5.3

• CVE-2026-7652unauthenticated≤ 5.5.0

  LatePoint <= 5.5.0 - Unauthenticated Account Takeover via Weak Password Recovery Mechanism

  Medium 5.3

• CVE-2026-5234unauthenticated≤ 5.3.2

  LatePoint <= 5.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Financial Data Exposure via Sequential Invoice ID

  Medium 5.3

• CVE-2026-1537unauthenticated≤ 5.2.6

  LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Missing Authorization to Booking Details Exposure

  Medium 5.3

• CVE-2025-3769unauthenticated≤ 5.1.92

  Latepoint <= 5.1.92 - Unauthenticated Insecure Direct Object Reference

  Medium 5.3

• CVE-2026-18441unauthenticated≤ 5.6.9

  LatePoint - Appointment Booking & Scheduling <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer[id]'

  Medium 4.3

• CVE-2026-9719unauthenticated · needs a click≤ 5.6.0

  LatePoint <= 5.6.0 - Cross-Site Request Forgery via invoices__change_status Action

  Medium 4.3

• CVE-2026-5365unauthenticated · needs a click≤ 5.3.2

  LatePoint <= 5.3.2 - Cross-Site Request Forgery via 'customer_cabinet__request_cancellation' AJAX Route

  Medium 4.3

• CVE-2025-14873unauthenticated · needs a click≤ 5.2.5

  LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Cross-Site Request Forgery

  Medium 4.3

• CVE-2026-13471login required≤ 5.6.3

  LatePoint <= 5.6.3 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure via Abilities R

  Medium 4.3